test(corpus): pin v0.3 structural projections

[Aaronontheweb]

Summary

• extend the executable corpus schema with opt-in syntax and command-occurrence expectations
• pin Bash and PowerShell structure, roles, ancestry, completeness, exact/null spans, and exact compatibility Clause identity
• add mixed list/pipeline and fail-closed hidden-execution cases
• make the PowerShell manifest own and reproduce all 310 entries without weakening explicit security assertions
• document the corpus contract and complete OpenSpec task 3.9

Security properties

• unparseable results must expose no command or compatibility projections
• unknown roles, ancestry enums, syntax kinds, and future unsupported node types fail closed
• dynamic wrappers, redirects, and undiscovered substitutions remain incomplete
• legacy entries remain compatible when structural expectations are omitted

Verification

• dotnet build -c Release
• dotnet test -c Release (1,228 passed)
• corpus + PII + real-pwsh oracle (502 passed)
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• dotnet format --verify-no-changes
• openspec validate v0-3-structured-shell-analysis --strict
• Slopwatch: 0 findings
• fresh PowerShell generation: byte-identical across all 310 entries
• adversarial review: GO on final patch fingerprint