Correct shell resolver provenance

[Aaronontheweb]

Supersedes #77. GitHub Actions did not enqueue validation for #77's corrected
head after substantive synchronize and reopen events, so this replacement
creates a fresh opened event without changing the reviewed branch.

Summary

• preserve ordered literal, typed-expansion, and opaque fragments from both shell lexers through resolution
• pass explicit Bash argument/redirect and PowerShell native/Path/LiteralPath/redirect contexts without changing the public API
• correct false exact, path, provider, wildcard, redirect, runtime-variable, command-identity, and ambiguous-binding classifications while keeping unknown forms fail-closed
• promote the landed compatibility cases into the executable corpora and complete OpenSpec tasks 2.1 and 2.2
• run live Bash shell oracles only on Unix, while keeping parser and corpus tests cross-platform

Security properties

• no decoded-text reconstruction of expansion eligibility
• opaque command identities cannot become literal verbs
• unknown runtime values, incomplete interpolation, ambiguous cmdlet binding, unproved PSDrives, and drive-relative paths remain DynamicSkip or unparseable
• exact mixed-fragment values resolve only when lexical, binding, home, cwd, and consumer facts are all proved
• v0.2 public API and public API snapshot are unchanged

Adversarial review

The independent implementation reviewer returned NO-GO until quoted Bash
cardinality, PowerShell variable/member identity, dynamic command identity,
ambiguous binding, PSDrive, drive-relative, redirect, and live-oracle gaps were
corrected. The final frozen implementation received GO with no remaining
security, API, provenance, span, compatibility, or task-completeness findings.

The CI-fix reviewer independently confirmed that all live Bash process calls
are Unix-gated, PowerShell execution is unchanged, and cross-platform parser
and corpus coverage remains intact.

Validation

• Release build: 0 warnings, 0 errors; netstandard2.0 and net8.0
• full suite: 1,120 passed locally
• focused lexer, provenance, corpus, and live-shell oracle matrix: 709 passed
• public API snapshot and corpus PII audit: 27 passed
• copyright headers, formatting, changed-file Slopwatch, strict OpenSpec, and diff hygiene passed

[Aaronontheweb]

Superseded by #79 from the identical reviewed commit on a fresh head ref. GitHub Actions never created a check suite for this PR's corrected head after two synchronize events; #79 exists solely to generate a new pull-request-opened event.