Adopt ShellSyntaxTree 0.3.0-alpha.1

[Aaronontheweb]

Summary

• Update ShellSyntaxTree to 0.3.0-alpha.1.
• Allow complete literal heredoc and bounded here-string data only for argument-free cat.
• Keep unknown data, receiver wrappers, interpreters, malformed facts, and command-resolution mutation strict.
• Show raw heredoc and here-string boundaries with visible ⏎ markers.
• Expand the Bash approval review table to 181 cases.

A direct shell dispatch such as bash -c stays transparent only after complete recursive analysis. Stored grants cannot bypass unresolved stdin data. PowerShell behavior does not change in this slice.

Validation

• dotnet build Netclaw.slnx -c Release --no-restore
• dotnet test src/Netclaw.Security.Tests/Netclaw.Security.Tests.csproj -c Release --no-build (763 passed)
• approval matrix tests (185 passed)
• dotnet slopwatch analyze (0 findings)
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• openspec validate adopt-shellsyntax-alpha1 --strict

An adversarial reviewer returned PASS after it checked the receiver grammar, malformed records, grant behavior, hard-deny order, display boundaries, and scope.