Classify quoted shell parameter expansion as unresolved #512

🤖 Generated by the Agentic Engineer

Problem and evidence

The read-only command guard does not account for every shell expansion inside double-quoted arguments. A synthetic offline replay demonstrates that an admitted argument can become a mutation request after native shell expansion. Its equivalent literal mutation is correctly rejected.

Expected outcome

Unsupported or dynamic argument expansion must not establish a read-only command. Classification must retain the actual shell boundary rather than treating an encoded word as its final value.

Acceptance criteria

• Pin the discrepancy with a native shell and a bounded offline argv observer.
• Cover positional and special shell parameters in quoted arguments.
• Deny unresolved expansions without evaluating them.
• Preserve the supported literal read-only command controls.
• Run guard and installed adapter tests.

Rough size: S. Part of #223.