Fix /dev/null approval scope

[Aaronontheweb]

Summary

• Do not turn the resolved POSIX /dev/null redirect target into a reusable /dev approval scope.
• Run the existing host symlink check before the null-device exception.
• Keep all other device paths, external redirects, dynamic redirects, and PowerShell paths strict.
• Add direct matcher regressions and an end-to-end approval matrix case.

User impact

Safe commands such as ls -la 2>/dev/null can use the trusted working-directory policy instead of prompting for /dev access. Commands such as tmux or systemctl can still prompt when their verbs require approval, but the prompt uses the invocation working directory instead of claiming that the command runs in /dev.

This is a Netclaw policy correction. It does not require a new ShellSyntaxTree package.

Security boundaries

• /dev/null.backup still creates a /dev scope.
• A second redirect such as >/etc/output.txt still creates an /etc scope.
• Dynamic targets remain fail closed.
• Host symlink checks run before the exception.
• Native PowerShell does not use the POSIX exception.

Verification

• Release solution build: 0 warnings, 0 errors.
• Full solution tests: 6,797 passed, 15 environment-specific skips, 0 failed.
• Bash approval matrix: 193 cases passed before the expanded full run.
• Slopwatch: 0 issues.
• File headers: verified.
• Formatting and git diff --check: passed.
• Adversarial security review: no remaining blocking findings after the symlink-order correction.