Pin hidden shell execution approval boundaries

[Aaronontheweb]

Summary

• Add strict matrix cases for unknown-state Bash parameter dereference, nameref-deferred execution, and the source builtin.
• Pin every case to one-shot approval with no reusable candidates.
• Make the existing PowerShell proved-data row use the exact payload from ShellSyntaxTree corpus entry 418.

This completes the downstream matrix evidence for the hidden-execution portion of ShellSyntaxTree OpenSpec task 3.13d. It does not relax production approval policy.

Validation

• Shell approval disposition matrix: 208 passed
• Verify snapshot: matched
• header verification: passed
• Slopwatch: zero findings
• git diff --check: passed
• adversarial review: PASS