[shell command] Reject shell globs in known safe Bash commands

[evawong-oai]

Summary

1. Reject unquoted shell expansion words when parsing Bash scripts for known safe command classification.
2. Preserve quoted literal forms so quoted star patterns still parse as literal argv.
3. Add a regression for the reported Base64 option injection shape.

Why

The known safe classifier was treating unquoted Bash words as stable argv. Bash can rewrite those words at runtime through glob, bracket, brace, or home directory expansion, so a command that looked read only during classification could become an output writing command when the shell executed it.

This PR keeps the fix inside the shell command parser and the safelist regression. It does not broaden unrelated command policy.

Validation

1. Local regression reproduced before the parser fix.
2. Local focused regression tests passed after rebasing onto current main.
3. Local full shell command crate passed with 137 tests.
4. AWS macOS VM replicated the raw Bash runtime primitive, then the patched classifier tests and full shell command crate passed with 137 tests.
5. AWS Windows VM ran the patched classifier tests through SSM, then the full shell command crate passed with 188 tests.

Ticket

CLI 8726