fix(tracker): detect every command registration and scope execute's TODOs

[BryanFRD]

Three faults in scanCommandFiles, all measured against a Steel checkout.

/execute collected every command's TODOs. The inner loop reads
for (const file of files), shadowing the outer file and walking all of builtins/
instead of the execute directory. /execute reported 9 TODOs where 5 live under
execute/, and /locate's and /summon's showed up twice, once on the real command and
once on /execute.

Commands whose factory is not named command() were missed. The pattern required a
literal |_| command(), so operator.rs (|_| op_command(), |_| deop_command()) and
return (command passed by reference) were reported unimplemented. It now accepts any
*command factory and the bare reference form.

The match loop could not terminate. The regex had no g flag, so exec kept returning
the same first match and the continue on command === "execute" would spin forever. It
never fired only because execute/mod.rs uses the reference form the old pattern missed.
With the flag set the break is no longer needed either, so a file registering more than
one command is read in full.

Effect

Same Steel checkout, script run before and after:

• commands implemented 28/90 to 31/90 (/op, /deop, /return), none lost
• /execute TODOs 9 to 5
• blocks, items and entities byte-identical

domain.rs's TODO goes with them: it registers through Identifier::from_steel, is absent
from commands.json, and was only ever visible through the /execute bug.

Tested

bun run build clean. tsc --noEmit clean under scripts/. Script run against the same
checkout with and without the change, outputs diffed field by field.

Touches the same function as #58, so whichever lands second needs a small rebase.