Correct shell resolver provenance

[Aaronontheweb]

Summary

• preserve ordered literal, typed-expansion, and opaque fragments from both shell lexers through resolution
• pass explicit Bash argument/redirect and PowerShell native/Path/LiteralPath/redirect contexts without changing the public API
• correct false exact, path, provider, wildcard, redirect, runtime-variable, command-identity, and ambiguous-binding classifications while keeping unknown forms fail-closed
• promote the landed compatibility cases into the executable corpora and complete OpenSpec tasks 2.1 and 2.2

Security properties

• no decoded-text reconstruction of expansion eligibility
• opaque command identities cannot become literal verbs
• unknown runtime values, incomplete interpolation, ambiguous cmdlet binding, unproved PSDrives, and drive-relative paths remain DynamicSkip or unparseable
• exact mixed-fragment values resolve only when lexical, binding, home, cwd, and consumer facts are all proved
• v0.2 public API and public API snapshot are unchanged

Adversarial review

The independent reviewer returned NO-GO until these counterexamples were corrected:

• quoted Bash $* cardinality and braced ${10} positional identity
• PowerShell $1 numeric-variable identity
• PowerShell bare member expressions versus inline expandable strings
• dynamic command identities, ANSI-C quoting, fd-shaped quoted redirects, ambiguous parameters, unproved PSDrives, drive-relative paths, and empty-value boundaries
• incomplete live-shell coverage across variable, provider, wildcard, and redirect contexts

The third frozen snapshot received explicit GO with no remaining security, API, provenance, span, compatibility, or task-completeness findings.

Validation

• dotnet build -c Release --no-restore - 0 warnings, 0 errors; netstandard2.0 and net8.0
• dotnet test -c Release --no-build --no-restore - 1,120 passed
• focused lexer, provenance, corpus, and live-shell oracle matrix - 709 passed
• public API snapshot and corpus PII audit - 27 passed
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• dotnet format --verify-no-changes --no-restore
• Slopwatch strict scan of every changed C# file - 0 findings
• openspec validate v0-3-structured-shell-analysis --strict
• git diff --check origin/dev...HEAD

[Aaronontheweb]

Replacing this PR from the same reviewed branch because GitHub Actions did not enqueue checks for the corrected head after substantive synchronize and reopen events. The replacement will cross-link this PR and preserve the full implementation.