Analyze ForEach-Object parallel child runspaces

[Aaronontheweb]

Summary

• expose ForEach-Object -Parallel as a concurrent once-per-input child-runspace execution region, including -AsJob
• model inherited cwd, isolated runspace-local state, pooled runspace reuse, -UseNewRunspace, and process-wide environment effects
• track rebound alias/function names in a bounded case-insensitive state so matching invocations fail closed without tainting unrelated command names
• extend the generated PowerShell corpus through entry 383 and synchronize the PowerShell spec, OpenSpec design, and implementation plan

Security notes

Unknown, dynamic, wildcard, or over-budget command-resolution mutations collapse to all unproved names. Exact names remain precise. Live PowerShell probes cover hidden environment writes through rebound aliases, rebound mutators, Function provider paths, and provider-qualified double-colon spellings.

The aggregate OpenSpec task 7.5c remains unchecked because remote/session Invoke-Command and pinned Start-ThreadJob are separate follow-up slices.

Validation

• Release build: clean for netstandard2.0 and net8.0
• full tests: 2,227 passed
• focused corpus, PII, and live oracle: 643 passed
• generated corpus: 383 entries, exact round trip
• file headers: verified
• Slopwatch: 0 findings
• openspec validate v0-3-structured-shell-analysis --strict: valid
• public API drift: none
• frozen staged SHA-256: 8aee970cc5aa6e16200ea6c104cce7dee10300d9ac610a33dca2dec676cac5a3
• adversarial review: GO after one blocked freeze found and corrected Alias::name / Function::name normalization