command-risk gate blocks routine read-only commands (2>/dev/null, grep -r, quoted heredocs) — fix attached

The command-risk classifier refuses ordinary read-only shell commands, which is the failure mode the crate docs warn about: over-firing trains users to reflex-approve, and a gate that is always tripped protects nothing.

Four defects, all cascading from how redirects are parsed:

1. 2>/dev/null tokenizes the fd as a word and /dev/null as a truncating redirect target. /dev/null sits under /dev, which is protected recursively, so the single most common shell idiom there is classified Catastrophic and cannot be run at all.

2. Any redirect makes every operand a delete target, because the target list is built unconditionally. grep -rn pat . > out reports . as a recursive delete and *.md as an unknown-footprint glob.

3. -r is read as "recursive delete" even when the program only reads, so grep -r and ls -R look destructive.

4. Quoted heredoc bodies are tokenized as code. A backtick or $ in documentation prose reads as command substitution, so writing a doc that merely mentions a path is blocked.

Fix: strip leading fds and >&N dups in the tokenizer; treat the discard sinks (/dev/null, /dev/zero, /dev/tty, stdout, stderr) as inert everywhere; only collect operands as targets when the program is actually destructive; require a destructive verb before -r counts as recursion; skip the bodies of quoted heredocs, which the shell itself does not expand.

Unquoted heredocs are still assessed, since the shell does expand those.

Reproduction

$ jcode run 'grep -rn TODO . 2>/dev/null'

refused as Catastrophic pre-fix (matches /dev/null under the protected /dev tree).

Fix

Patch attached (command_risk_fix.diff), scoped entirely to crates/jcode-command-risk/. It applies cleanly on current master (b80d9eb92) with no conflicts.

cargo test -p jcode-command-risk: 64 passed, 0 failed, including tests confirming rm -rf ~, device writes, out-of-cwd deletes, and clobbering redirects are all still gated.

Branch with the commit, if a maintainer would rather cherry-pick directly:
https://github.com/rameshbaskaran/jcode/tree/fix/command-risk-on-v66

(Repo settings restrict PR creation to collaborators, so filing this as an issue with a ready patch instead of a PR.)

Start in crates/jcode-command-risk/ and run cargo test -p jcode-command-risk to inspect the existing 64 tests and reproduce the grep command shown in the issue. Compare redirect, recursion, discard-sink, and heredoc behavior with the stated cases; done means routine read-only commands pass while destructive cases such as rm -rf ~ and device writes remain gated.