Migrate shell policy to ShellSyntaxTree alpha.6

[Aaronontheweb]

Summary

• Update ShellSyntaxTree from 0.3.0-alpha.5 to 0.3.0-alpha.6.
• Use the closed alpha.6 value-domain, redirect, redirect-source, and joined-argument types.
• Keep the existing bounded Bash leaf-glob policy and fail closed for unknown or future analysis types.
• Replace alpha.5 malformed property-bag fixtures with parser-originated integration cases.

Verification

• dotnet build Netclaw.slnx -c Release --no-restore: passed with zero warnings and errors.
• dotnet test Netclaw.slnx -c Release --no-restore --no-build: 6,770 passed, 15 expected skips, zero failed.
• Existing Bash and PowerShell disposition matrix: 225 passed unchanged.
• Security tests: 809 passed.
• Header verification: passed.
• Slopwatch: zero issues.
• Adversarial security review: no blockers.

This change does not alter the tool schema, model prompt, shell selection, or executor behavior. It migrates the approval policy to the corrected prerelease consumer API. Model evals were not applicable and were not run.