Use ShellSyntaxTree v0.3 for Bash approvals

[Aaronontheweb]

Summary

• Upgrade ShellSyntaxTree from 0.2.0 to 0.3.0-alpha.
• Consume complete command occurrences, working-directory facts, and typed redirect analysis.
• Remove the raw descriptor-prefix workaround from the 0.2 consumer.
• Avoid redundant prompts for completed descriptor and project-local redirect forms.
• Keep heredocs, dynamic descriptors, unsupported cwd domains, and incomplete facts approval-sensitive.

Security

• Evaluate every visible command occurrence before grants.
• Preserve hard-deny ordering and cover Bourne-compatible shell wrappers.
• Reject malformed or future enum values.
• Reject redirect targets whose existing path contains a symlink.
• Preserve exact cwd attribution through bundled shell wrappers.
• Keep PowerShell integration in its separate pass.

Validation

• dotnet build -c Release passed with zero warnings.
• dotnet test -c Release --no-restore passed.
• The security project passed 695 tests.
• The disposition matrix passed 121 reviewed cases.
• File-header verification and Slopwatch passed.
• Adversarial review returned GO on staged hash b4a89cd6d84c7e088b67a9281edc173e2f6065f48c1f359f3d8a36819fd97eda.