Close shell approval gaps exposed by the Bash corpus

[Aaronontheweb]

Problem

PR #1750 adds a Bash approval corpus against the Personal install policy. The corpus exposes four gaps in current production behavior.

1. echo safe | netclaw daemon stop requests approval instead of a hard denial.
2. echo $(git push) receives automatic access through the side-effect exemption.
3. git status & git push receives automatic access through the safe-verb policy.
4. bash -lc "git push" checks the wrapper instead of the nested command.

The fourth gap causes two incorrect approval results. A stored git push approval does not match, but a stored bash approval authorizes the nested mutation.

The first gap weakens the hard-deny result. The other gaps can broaden or bypass automatic authorization.

Issue #1693 covers the pipe-tail parser gap. This issue adds the complete regression contract from the corpus.

Required behavior

The shell policy must evaluate the complete command structure before it grants automatic access.

• A hard-deny match in any executable clause must deny the complete invocation.
• A safe outer clause must not hide an unsafe command substitution.
• A safe foreground clause must not hide an unsafe background clause.
• A wrapper approval must not authorize an arbitrary nested command.
• The nested command must use its canonical approval identity.
• Dynamic or unsupported command structures must fail closed.

Acceptance criteria

After PR #1750 merges, rebase PR #1733 and run the Bash approval matrix.

• hard-deny-pipeline-tail-currently-prompts returns Denied with hard_deny_self_destructive.
• command-substitution-currently-auto-allows no longer returns Allowed.
• background-list-currently-auto-allows no longer returns Allowed.
• nested-shell-wrapper-grant-currently-allows no longer accepts the wrapper grant alone.
• A stored approval for the canonical nested command can match that command.
• The matrix snapshot shows each new result and authorization reason.
• Focused unit tests cover each structural rule.

Relationship

PR #1733 should close this issue with its ShellSyntaxTree policy work.