Fix shell approval scopes for dotted paths

[Aaronontheweb]

This PR reduces repeat shell approval prompts.

It makes these changes:

• Preserve dotted directory scopes for Bash and native PowerShell navigation.
• Recognize drive-rooted, UNC, relative-rooted, and quoted Windows path roots under the selected shell grammar.
• Keep Git refs, module-qualified names, URLs, PowerShell provider paths, external paths, and symlink checks strict.
• Normalize variable git ls-tree operands to the reviewed read-only verb.
• Keep other Git subcommands exact.
• Add sanitized approval cases with synthetic paths and branch names.
• Isolate the static-glob test from shared runner state.

Validation:

• Release build passed with no warnings.
• Local Security and focused actor approval suites passed.
• Native Windows CI proved the dotted directory result is the canonical full path C:/workspace/service.repo.
• Header verification passed.
• Slopwatch found no new issues in changed files.
• The added diff passed the PII scan.
• The adversarial review passed with no findings.