feat(tool): hand-written Bash AST analyzer for nested-danger detection

[Patel230]

The regex safety layer in bash.go (IsDestructiveCommand, IsSuspicious, hardDenySubstrings) is text-pattern based. It catches most dangerous commands but has a real gap: it cannot see into the inner of $(...) substitutions, backticks, <( ) process substitutions, or heredoc bodies. So:

• 'echo $(rm -rf /tmp)' is caught because the outer string contains 'rm -rf'.
• 'cat file | bash' is caught by the pipe-to-shell regex.
• 'cat <<EOF | tee log\n$(rm -rf /tmp)\nEOF' is NOT caught by regex — the body of the heredoc is invisible.
• 'diff <(ls dir1) <(ls dir2)' is caught by the process-substitution regex but the inners are not recursed.
• 3-level deep nested '$(echo $(echo $(rm -rf /deep)))' is not handled — the regex only sees the outermost string.

Add a hand-written Bash tokenizer + parser + walker in
internal/tool/bash_ast.go (~600 LOC including tests) that:

• Tokenizes: single/double-quoted strings, $() command substitution,
  backticks, $VAR / ${VAR}, <( ) and >( ) process substitution,
  <<TAG heredocs (with proper body detection + terminator-on-own-line
  recognition), redirections > >>, backslash escapes.
• Parses: a flat list of statements separated by ; or newlines, each
  statement split into segments at | || && &.
• Walks: each segment is checked for command-substitution / backquote /
  process-substitution tokens; for each such token, the inner body
  is recursively tokenized + walked. Heredoc bodies are also
  inspected.
• Bridges: the inner is also checked via the existing IsDestructiveCommand
  • isHardDeny predicates so the AST layer surfaces the same kinds of
    dangers the regex layer does, but for inner bodies.
• Bounded recursion: maxASTDepth=256 prevents pathological nesting.

The AST analyzer is wired into BashTool.Execute as a second-pass safety
check. When the walker emits any findings, the command is hard-denied
with a structured error listing the findings (category, snippet, position).

17 test cases in TestBashASTAnalyzer:

• Subshell with dangerous inner is flagged.
• Subshell with safe inner is NOT flagged (inner has no danger).
• Heredoc with $(cmd) in body is flagged.
• 3-level nested substitution recursion works.
• Max-depth bound prevents stack overflow.
• Quoted/escaped patterns are correctly tokenized.

This is the hand-written equivalent of the mvdan.cc/sh dependency that
the hawk-eco workspace can't currently add (go get fails on internal
version conflicts). It's a focused subset — large enough to catch the
dangerous patterns the regex layer misses, small enough to be reviewable
in one sitting, and free of the 50K-LOC dep.

Verification: go build ./... \u2713, go test ./internal/tool/ \u2713.