feat(hooks): shell write-interception and regression suite

[zaxbysauce]

Summary

• Added POSIX shell write detection via bash-parser AST analysis for 8 write categories
• Added Windows shell write detection via regex heuristics
• Implemented scope path resolution with subshell cd tracking
• Added interactive/session tool denial
• Added cross-process scope persistence with TTL and symlink guards
• Added 348 regression tests across 4 test files
• Fixed interactive session bypass for 'bash' shell type

Invariant audit

• 1 (plugin init): not touched
• 2 (runtime portability): touched - added bash-parser dependency; build and node import verified
• 3 (subprocesses): not touched
• 4 (.swarm containment): touched - scope persistence uses existing containment helpers
• 5 (plan durability): not touched
• 6 (test_runner safety): not touched
• 7 (test writing): touched - 4 new test files with bun:test, no mock.module, proper cleanup
• 8 (session state): not touched
• 9 (guardrails/retry): touched - added checkShellWriteScope to guardrails hook
• 10 (chat/system msg): not touched
• 11 (tool registration): not touched
• 12 (release/cache): not touched

Test plan

• bun run build passes
• node --input-type=module import passes
• 348 tests pass
• biome ci passes
• Release note fragment created