fix(guard): refuse a recursive delete of the root or the home, and fix three v0.11.1 gate findings

[REPPL]

The v0.11.1 release gate found four things wrong with what abcd tells people. Three are fixed here, and the fourth waits for a product decision.

• The shell-hazard guard let rm -rf /, rm -rf ~ and rm -rf $HOME through, although its chapter promised it catches an rm -rf with an unlucky glob. A recursive delete of the filesystem root, the home directory or every dotfile in the home (rm -rf ~/.*) is now blocked, in every flag spelling and behind sudo, env and command. A recursive delete of *, ., .. or $PWD is now warned about, graded like git clean, because emptying a build directory that way is ordinary work. Deleting a named directory (rm -rf ./build, rm -rf /tmp/x, rm -rf ~/.cache/x, rm -rf .git) is still allowed.
• abcd update --json printed two JSON documents when it refused. It now prints one: the receipt, carrying the refusal envelope's abcd, error and exit_code fields, with no empty origin.
• The bare abcd lint help said it runs every target, but the outbound target was never part of the bare run. The help now says "every target but outbound".
• abcd banlist list with no flags does exactly what bare abcd banlist does. The naming chapter forbids that shape, but every remedy changes a shipped verb, so the record is deferred past v0.11.1 until the product thinker picks one.

For the security reviewer

The guard change adds one optional field to the registry's pattern schema, arg_values: some operand must be exactly one of the listed words, compared by its text before the shell expands it. An empty or dash-led value is refused at load. The field is used by two bundled entries:

• rm-rf-root-or-home (blocker): /, /*, ~, ~/, ~/*, ~/.*, $HOME, $HOME/, $HOME/*, $HOME/.*, ${HOME}, ${HOME}/, ${HOME}/*, ${HOME}/.*.
• rm-rf-working-directory (warn): *, */, ., ./, ./*, ./*/, ./.*, .., ../, ../*, .*, $PWD, $PWD/*, ${PWD}, ${PWD}/*.

Both entries need only the recursive flag, not -f: an agent's stdin is not a terminal, so rm never prompts it, and -f changes nothing about what gets deleted. Two cases are deliberately not caught, and both are recorded in DECISIONS.md. The first is a target printed whole by a substitution (rm -rf $(echo /)), which is read by its known text, the same way a + refspec prefix is. Reading it as every possible target would block rm -rf $(find . -name '*.pyc'). The second is a target spelled any other way (rm -rf "$DIR"/* with DIR unset, rm -rf /?*). The cost tests' per-byte work bar goes from 20 to 24, because the operand walk reads every token once per entry; the measured maximum is 20.3 after the merge with main. rm-rf-after-cd-chain still needs -f; changing it is left as a separate act, recorded in DECISIONS.md.

Re-merge and fix

This branch merges main (#741). Main's guard reads a variable such as $HOME as a value it cannot know, so the operand compare above lost the variable's name: rm -rf $HOME was allowed, and rm -rf $OUT/ was blocked as a delete of the root. The compare now reads each operand as the line wrote its variables ($HOME, ${PWD}), in a record only that compare reads. A substitution's output is dropped as before, and a variable whose name is not known matches nothing. For a string handed to a shell (sh -c "rm -rf $HOME"), the string is read a second time with its variables written out, and the names are taken only where both readings agree word for word. Every other entry reads exactly what main reads: over 12,515 inputs (every string in the guard's tests, both corpora and every bundled fixture, each also inside sh -c and bash -c), main's tip and this branch, with the two new entries removed, give identical verdicts. A brace expansion's words and a default such as ${HOME:-/} have no written spelling and stay among the residuals. The per-byte work bar stays at 24, because the merged registry measures 20.3 on its costliest shape with or without this fix.

Resolves: iss-2609282105242542
Resolves: iss-2609282105241960
Resolves: iss-2609282105240689
Resolves: iss-2609290321312087
Refs: iss-2609282105240081

Assisted-by: Claude:claude-opus-5-5