Implement Bash here-string analysis

[Aaronontheweb]

Summary

• tokenize bare, numeric-descriptor, and line-continued Bash <<< with longest-match behavior
• publish explicit HereString redirect facts as non-path data with one deterministic trailing newline
• retain unknown dynamic operands while keeping structurally complete redirects complete
• suppress field splitting and pathname expansion in accordance with native Bash behavior
• propagate finite loop-bound data, including through decoded bash -c payloads
• expose command substitutions as independent occurrences and fail closed on malformed or unsupported forms
• correct the authoritative SPEC operator lists to include bare and numeric <<<

Security boundary

• no public API change
• unknown values remain Unknown; they are never guessed
• malformed here strings make the full parse unparseable
• compatibility redirects stay conservative; v0.3 consumers use occurrence-level RedirectAnalysis for stdin-sensitive policy

Evidence

• adversarial review: PASS, no remaining blockers or suggestions
• native Bash oracle: newline, field splitting, pathname expansion, tilde, variables, and command substitution
• decoded wrapper and finite loop-domain tests
• dotnet build -c Release: clean
• dotnet test -c Release: 2562 passed
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify: passed
• openspec validate v0-3-structured-shell-analysis --strict: passed
• Slopwatch: 0 issues
• stable patch ID preserved across rebase onto dev