Implement analyzer-owned Bash loop state

[Aaronontheweb]

Summary

• move Bash loop binding values out of structural parsing and into the abstract-state analyzer
• preserve ordered and duplicate visits, empty-loop success-only flow, post-loop binding lifetime, bounded fixed points, and a 4096-transition fail-closed budget
• join effective argument facts per occurrence while leaving compatibility arguments authored and dynamic
• remap decoded bash -c loop plans plus argument/cwd provenance by exact references and fail closed on any missing side fact
• keep cwd-changing, variable-mutating, and control-transfer loop bodies rejected until complete effective-argv transfers land
• expand the Bash corpus through cases 239-242 and update prior loop cwd expectations now that reached nonmutating bodies retain exact cwd

Deliberate boundary

This advances OpenSpec 6.5c.2. OpenSpec 6.5c.3 remains open for re-parsing complete effective argv during state transfers, including loop-derived cd options, before removing the temporary mutation guard.

Validation

• dotnet build -c Release --no-restore
• dotnet test -c Release --no-build — 1,620 passed
• dotnet format --verify-no-changes --no-restore
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• openspec validate v0-3-structured-shell-analysis --strict
• slopwatch analyze -d . --hook --no-baseline
• adversarial GO for staged fingerprint 6e2af6fa95e6b3b013dcff60db3d4b1e79d8ba3b05a8864f078262b371cb7402