Add structured PowerShell command substitutions

[Aaronontheweb]

Summary

• discover supported PowerShell $() commands across arguments, redirects, expandable strings and here-strings, standalone statements, dynamic identities, and host wrappers
• preserve current-scope cwd propagation and distinguish parent-expanded from literal child-host payloads
• fail closed on arbitrary expression values, execution-bearing @() / @{}, member suffixes, unsupported inner here-strings, and structural-depth overflow
• expand the generated PowerShell corpus from 310 to 341 entries and update the consumer/spec contracts

Security model

• executable occurrences project innermost-first before their consumer
• unsupported or incomplete expression shapes produce empty command and compatibility projections
• dynamic command identities and redirect values remain incomplete
• structural completeness and policy-sensitive value safety remain separate consumer decisions

Verification

• adversarial review GO: dbedcd1a5b4172cab4ad1a434093986f29e9542c6a2985b268e75bb5af0bfded
• dotnet build -c Release --no-restore
• dotnet test tests/ShellSyntaxTree.Tests/ShellSyntaxTree.Tests.csproj -c Release --no-restore (1,384 passed, including live PowerShell oracle)
• exact 341-entry corpus regeneration round-trip
• dotnet format --verify-no-changes
• header verification, OpenSpec strict validation, JSON validation, diff check, and Slopwatch

Remaining v0.3 work

PowerShell foreach expression discovery and Netclaw approval-matrix integration remain separate follow-up slices.