fix(hook): keep commands inside command substitutions untouched

[jsiu93]

Problem

The hook rewrites commands that appear inside $(...) or backtick substitutions. For example:

curl -X POST "$URL" --data-binary "$(jq -cn --arg p "$P" '{payload:$p}')"

becomes "$(rtk jq -cn ...)". The inner command's output is data consumed by the outer command, so the compacted output plus the tee pointer corrupt it. Same root cause as #1109 (git inside $(...)).

Fix

Before the existing top-level rewrite, a single pass masks complete $(...) and paired backtick substitutions (nesting, escapes, quotes and comments respected; single-quoted text stays literal). The top-level decision runs on the masked command, then the original slices are restored byte-for-byte. No regex, no new dependency, no change to heredoc, pipeline or xargs handling.

Tests

8 unit tests in registry.rs: outer rewrite with inner $(...) kept, unsupported outer command returns None, backtick variant, single-quoted literal, nested substitutions, operators and ) inside a substitution comment. cargo test, cargo clippy --all-targets -- -D warnings, cargo fmt --check all pass.

Fixes #1109. Refs #3558, #1282. Supersedes the subshell part of #2693, which has conflicts.

[pszymkowiak]

Closing: already fixed on develop. Since #2286 (v0.42.3) the hook defers any command containing an unquoted $(...), backtick or process substitution before the registry rewrite runs, and #3343 (v0.49.0) handles the piped-producer case from #3558. Verified with rtk rewrite and rtk hook claude on the #1109, #3558 and this PR's own test commands: every substitution-bearing line is left untouched. Rewriting the outer command around a masked substitution, which this PR adds, would be unreachable behind that defer; whether nested commands should ever be rewritten is tracked in #1252. Thanks for the PR.