fix(agent-guard): scope Segment.raw to its own tokens, not the whole command

[AmirF194]

split_segments() builds every Segment in a compound command as Segment(current, command), passing the whole input string as raw regardless of which segment it is. guard_commit_trailer searches seg.raw for co-authored-by:, so it was really searching the entire line, not the commit's own message. A git commit with a clean message gets denied if an unrelated earlier segment (a comment, a grep, an echo) happens to contain that phrase.

Fixed by giving each segment raw = shlex.join(current), a reconstruction of that segment's own tokens only. It still supports the heredoc-survival case the docstring describes: shlex.split doesn't parse << specially, so a heredoc's delimiter and body just become ordinary tokens attached to the segment they trail, and shlex.join puts them back as one searchable string. Checked the field's only other reader, GuardContext.raw: none of the four guards.d/skill-contributed guards use it, so the fix's blast radius is exactly the one guard this issue is about.

Added test_compound_command_other_segment_not_denied, the new test breaks without the change and passes with it. Full tools/agent-guard suite (92 tests), ruff, ruff format and mypy all come back clean in a python:3.11-slim container.

Fixes #1150

[potiuk]

Good catch, and the diagnosis is exactly right: passing the whole command as every segment's raw meant a substring scan could not tell which segment the text came from, so any mention of the phrase anywhere on the line poisoned every other segment.

Since this is a security guard, I tested the false-negative direction specifically — narrowing raw could plausibly have weakened detection rather than just removing the over-match. It does not:

Command	Result
git commit -m "fix\nCo-Authored-By: ..."	denied
cd /tmp && git commit -m "x\nCo-Authored-By: a"	denied
git commit --amend -m "Co-Authored-By: x"	denied
heredoc commit containing the trailer	denied
heredoc commit, clean message	allowed
echo "...Co-Authored-By..." && git commit -m "clean fix"	allowed (the fix)

The heredoc row is the one that mattered: the docstring you updated claims raw exists for "substring scans that survive heredocs", so shlex.join had to preserve that property — and it does, because the heredoc body is already in the segment's own token list.

I also confirmed the bug on main before the fix: that last case is denied there today, so this is a real false positive being removed, not a hypothetical.

Docstring updated to match the new semantics, which is the part these changes usually miss.

---

🤖 This review was drafted by an AI-assisted tool and may contain mistakes. It has been reviewed and confirmed by an Apache Magpie maintainer before submission. See CONTRIBUTING.md for what this project considers a maintainer review.

[AmirF194]

Good call testing the false-negative direction specifically, the heredoc row is exactly the one I'd have worried about if I'd only checked that the over-match went away.