Document post-swap shell approval evidence

[Aaronontheweb]

Summary

• freeze the first approval sample after the PR Reduce approval prompts for causal Bash diagnostic chains #1925 binary swap
• classify all nine prompts with sanitized command shapes
• pin the observed six expected approvals and three agent-guidance misses

Validation

• ShellApprovalEvidenceContractTests: 14/14
• source-generated JSON binding
• evidence PII audit
• dotnet format
• git diff --check

This PR is stacked on #1926 and contains no production changes.