Implement bounded Bash heredoc analysis

[Aaronontheweb]

Summary

• expose typed Bash heredoc delimiter, body, expansion, tab-stripping, and completeness facts, including numeric source descriptors
• recursively discover supported expanding-body substitutions while rejecting hidden execution and incomplete forms atomically
• require proved Bash variable-attribute state and fail closed on the locked execution-bearing builtin catalog and dispatch wrappers
• add native Bash oracles, typed executable-corpus assertions, and synchronize the OpenSpec and implementation plan

Validation

• dotnet build -c Release — 0 warnings/errors
• dotnet test -c Release --no-build — 2,455 passed
• strict OpenSpec validation, headers, PII/API checks, git diff --check, and Slopwatch — passed
• adversarial review — PASS; 136 generated bypass probes, 0 failures

Scope

Command-resolution mutations (exec, mutating hash, alias/shopt, and enable forms) are intentionally handled in the next separate fail-closed slice.