Add bounded PowerShell foreach structure

[Aaronontheweb]

Summary

• parse the bounded PowerShell foreach structural slice into the locked ForEachSyntax shape
• expose iterator and loop-body occurrences while leaving loop bodies and current-scope continuations incomplete pending value/state analysis
• preserve contextual foreach alias behavior and correct statement terminator versus pipeline-chain grammar
• fail closed on dynamic iterables and recognized state/command-resolution mutations, including provider-qualified forms
• expand the generated PowerShell corpus from 341 to 361 entries with live pwsh oracle coverage

Safety boundary

This PR intentionally does not publish exact/finite loop binding values or post-loop state. Tasks 7.3-7.7 remain open pending the explicit PowerShell initial-runspace contract and abstract-state analyzer.

Validation

• dotnet build -c Release --no-restore (0 warnings)
• dotnet test -c Release --no-build --no-restore (1,739 passed)
• dotnet format --verify-no-changes --no-restore
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• openspec validate v0-3-structured-shell-analysis --strict
• PII audit and native PowerShell oracle green
• Slopwatch: 0 issues

Adversarial review

GO for exact staged fingerprint 4948791292e7b7661b1a2061a5bac02a1af2b7649ab41bf512f5a5382cdca232 after three earlier NO-GO snapshots exposed and fixed command-resolution mutation, quoted/provider-qualified path, continuation completeness, and statement-boundary bugs.