Require explicit Bash loop initial state

[Aaronontheweb]

Summary

• fail bounded Bash for-in analysis closed unless the caller proves an isolated non-interactive initial state
• restrict the first scalar binding grammar to reviewed lowercase ordinary names and reject Bash magic or identity-sensitive names
• preserve or downgrade the initial-state assertion across cwd clones, substitutions, subshells, and decoded bash -c wrappers
• synchronize SPEC, OpenSpec, the implementation plan, and the consumer guide with the analyzer-owned loop-state design
• add nine executable corpus cases and real Bash oracles for HOME, RANDOM, LINENO, PATH, CDPATH, IFS, and wrapper export state

Security rationale

The earlier parser-time binding model could publish false exact facts for special Bash variables and could authorize a compatibility path under the configured HOME after Bash had rebound HOME. The safe default is now Unknown. IsolatedNonInteractive is an explicit execution contract, not an inferred convenience.

Validation

• adversarial review GO for staged fingerprint 752c23d5c7aa93be56c8fa59d3257b02b118a24d445228c6c8b54c0c8c6dede0
• dotnet build -c Release
• dotnet test -c Release --no-build: 1,599 passed
• focused API, loop, oracle, and corpus suite: 872 passed
• strict OpenSpec validation
• header and formatting verification
• Slopwatch: zero findings
• corpus PII audit via full test suite