Allow unknown Bash argument data

[Aaronontheweb]

Summary

• treat unresolved Bash parameter expansion as structurally safe only after ShellSyntaxTree classifies it as a non-path argument
• keep dynamic command identities, paths, redirects, substitutions, and command-string execution fail closed
• cover the sanitized gh run view ... | head; echo "$?" diagnostic in focused and approval-matrix tests

This is deliberately syntax-general. It adds no executable, subcommand, option, or operand-specific approval parsing.

Validation

• focused ShellCommandAnalysis and ShellApprovalMatcher tests: 141 passed
• full Security suite: 841 passed
• full solution suite passed locally (one expected Windows-only skip)
• copyright headers verified
• Slopwatch: 0 issues
• adversarial review: PASS
• sanitized case scan: no PII