PowerShell: add foreach abstract-state analysis

[Aaronontheweb]

Summary

• propagate bounded PowerShell foreach bindings and working-directory state across ordered, empty, and fixed-point iterations
• model current-runspace versus child-host state, failure-aware Set-Location outcomes, provider and command-resolution mutations, and variable-writing parameters
• fail closed on unsupported module-qualified mutations, alternate PowerShell parameter dashes, unmodeled pipeline transfers, dynamic Invoke-Expression loop transfers, and transition-budget overflow
• synchronize the locked spec, OpenSpec scenarios, implementation plan, executable corpus, design corpus, and live PowerShell oracle coverage

Security review

The exact staged snapshot was adversarially reviewed. Review found and drove fixes for alternate parameter dashes, module-qualified mutation bypass, computed Invoke-Expression state poisoning, and Set-Location/common-writer outcome composition. Final disposition: GO with no commit-blocking findings.

Validation

• openspec validate v0-3-structured-shell-analysis --strict
• dotnet build -c Release --no-restore
• dotnet test -c Release --no-build --no-restore: 1,916 passed
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• dotnet format --verify-no-changes --no-restore
• slopwatch analyze -d . --hook --no-baseline --fail-on warning
• git diff --check