[Susensio]

Closes #1083.

A cd ~/… target used to render the effective directory unknown, so every relative token after it was resolved against the session cwd — a path the shell never reaches and no rule can match — and a ./-prefixed token was not projected at all.
~/ is static: bash expands it from HOME before cd runs.

This folds an unquoted ~ / ~/… target to os.homedir() plus the rest of the word verbatim, under the ShellVariables rule the token projection already applies.
The rest is spelled verbatim rather than through expandHomePath, whose join would drop the separator a following concatenation part relies on (cd ~/"work").

What keeps the unknown base, and why:

• a program that rebinds HOME (HOME=/tmp cd ~/x), the existing spellsReboundHome rule;
• ~user, which reads the password database rather than HOME;
• ~"work", because bash ends the tilde-prefix only at an unquoted slash, so that word is the literal ~work;
• ~\/work, because the backslash quotes the slash and bash expands nothing;
• a quoted ~ (cd "~/x", cd '~/x'), which is not a tilde-prefix at all and stays the relative literal it is;
• bare cd and cd -.

Seven cases cover the fold in test/access-intent/bash/program-external-accesses.test.ts; ~/work && cat ../notes.txt projects <cwd>/../notes.txt without the src change.
The existing unknown-base case now uses cd "$DIR" so it keeps testing what its name says.

Checks, from the repo root:

pnpm --filter @gotgenes/pi-permission-system run test    # 6420 passed
pnpm --filter @gotgenes/pi-permission-system run check   # clean
pnpm --filter @gotgenes/pi-permission-system run lint    # clean

Docs: ADR 0009 amendment (2026-10-24), the completeness contract, docs/configuration.md, and the bash-path-resolver.ts architecture entry.

Out of scope, and still unknown: $HOME/x as a cd target, bare cd, and cd -.