Security: harden command execution against shell-path hijacking

[ghantoos]

• Add a shared expansion inspector (lshell/expansion_inspector.py) and use it in both sec and engine authorizer paths.
• Enforce recursive validation of nested shell expansions ($(), backticks, process substitution, arithmetic/parameter expansions).
• Fail closed on malformed or unsupported expansion/syntax patterns.
• Harden path checks with safer wildcard handling (brace expansion limits, extglob fail-closed behavior, improved token/path detection).
• Block environment-based breakout vectors by rejecting BASH_FUNC_* exports/sourced vars and scrubbing BASH_FUNC_* from child process environments.
• Keep SSH (overssh) allowlist behavior consistent for nested expansion payloads.