Security: shell classifier convergence waves M-P under v16-v20 adversarial audits (PR #48638 series)

Context

Part of the fork hardening series proposed in #48638 (branch session-diff-events). Tracker: #49565.

Problem

Convergence waves under repeated adversarial audit (v16-v20): remote-CLI global option handling, podman/local-file subcommands, quoted substitution payloads, attached-value precision, order-aware variables, evalScript program-text channels, payload-local scopes, redirect-site scoping, quote handling in option names, --opt= attached values, and an exponential-expansion regression in the variable resolver.

Change set (commit list)

• 9c5eb44d12 wave M-A shell
• 264134c2b6 wave N shell
• f50f02b0ce wave O shell
• 7063bdd9ea wave P shell

Validation

• Final deepseek convergence gate: CONVERGED (1,122 replay rows, 0 negative flips; all named findings closed with real-effect proofs incl. live docker exfil gated both directions).
• Shell suite 108/0 (pre-existing load-correlated truncation flake noted, arm-independent); all cross-suites green; typechecks green.
• Intended to land as a standalone stacked PR.

Linked: PR #48638 · tracker #49565 · sibling tracking issues listed in a follow-up comment.

Start by reviewing PR #48638, tracker #49565, and commits 9c5eb44d12, 264134c2b6, f50f02b0ce, and 7063bdd9ea. Run the named shell suite and cross-suites, then verify the convergence gate remains green with no negative flips and that typechecks pass.