Correct Bash abstract-state semantics

[Aaronontheweb]

Summary

• make Bash state flow outcome-sensitive across &&, ||, separators, pipelines, and cd failure
• distinguish ordered loop iteration plans from public value-domain summaries, including empty and duplicate-bearing iterables
• preserve the fail-closed <dynamic-cwd> compatibility marker while clearing false exact path resolutions
• lock lastpipe / pipefail, decoded-child versus subshell inheritance, and execution-transfer rejection
• add five Bash design-corpus cases plus Group support in the design harness

This is the design correction required by the task 6.5 halt. Production state-analysis code follows only after this contract merges.

Verification

• dotnet build -c Release
• dotnet test -c Release --no-build (1,527 passed)
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• openspec validate v0-3-structured-shell-analysis --strict
• slopwatch analyze -d . --hook --no-baseline
• exact staged-fingerprint adversarial GO: fc3044e6bcd39ad2d225961a727ecd116031e786b7f8a1901454351681b565c7