Security: fail-closed shell classifier hardening (waves H-L of PR #48638 series)

Context

Part of the fork hardening series proposed in #48638 (branch session-diff-events). Tracker: #49565.

Problem

The shell/command classifier could be steered past the external_directory gate and absorb its own offered grants (fail-open classifications) across many shapes: brace lists, wrappers, absolute paths, redirects, dynamic names, env/eval, ANSI-C escapes, attached options, remote operands, substitutions, variable redirects, and more.

Change set (commit list)

• 85fd685fc1 tool/permission security
• 77589d5d1a wave H-A shell
• 3f69dad8a4 wave I-A shell
• 4618e51749 wave J-A shell
• ae98cd2397 wave K shell
• 7b7e70a6c1 wave L remote/attached

Validation

• Adversarial base-vs-head proofs for every closed class; official suites green; no new prompts on benign corpora.
• Intended to land as a standalone stacked PR (see PR #48638 for the integration branch).

Linked: PR #48638 · tracker #49565 · sibling tracking issues listed in a follow-up comment.

Start with PR #48638 and tracker #49565, then review the listed waves H-L and their shell-classifier changes. Use the adversarial base-vs-head proofs and official suites described in the issue; done means the listed fail-open classes are closed without new prompts on benign corpora.