feat(core): parse shell permission commands

[rekram1-node]

Summary

• parse Bash and PowerShell commands with tree-sitter before permission checks
• split compound shell input into independent permission resources
• derive reusable command-prefix approvals using V1 arity rules
• preserve V2 explicit-workdir-only external-directory checks

Validation

• bun test test/shell-parse.test.ts test/tool-shell.test.ts in packages/core
• bun typecheck in packages/core
• git diff --check