Complete Bash loop coverage matrix

[Aaronontheweb]

Summary

• cover multiline and mixed-separator Bash loops with static and binding-derived redirects
• add fail-closed indirect and parameter-operator corpus cases plus body substitution and transition-budget coverage
• add native Bash oracles for empty, pipeline, nested, unquoted, option-shaped, substitution, and wrapper-scope behavior
• complete OpenSpec tasks 6.6 and 6.7 while leaving explicit redirect analysis separately open

Validation

• dotnet build -c Release --no-restore
• dotnet test -c Release --no-build --no-restore (1,678 passed)
• dotnet format --verify-no-changes --no-restore
• openspec validate v0-3-structured-shell-analysis --strict
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• PII audit and targeted Slopwatch
• exact staged adversarial review: GO for 64442ab3e562abdac77a548abe2cb59c8c52f7636e937ca5c538fa6ea087f38e