Surface unknown PowerShell execution regions

[Aaronontheweb]

Summary

• attach command-argument script blocks as conservative unknown execution regions with exact host coordinates and recursive supported body commands
• fail atomically for unsupported execution-bearing interiors, including hidden assignment and expandable-string subexpressions
• poison observing cwd, variable, and command-resolution facts until receiver scope/timing is proved, while preserving child-process isolation
• keep pure output expressions visible without inventing command occurrences

This is the preparatory structural-emission slice. Typed receiver facts and shell-specific region state flow remain in OpenSpec tasks 7.5b-7.5e.

Validation

• adversarial review: GO on staged SHA-256 cbe9d8bdb3c8e08fd60ba5cdd6bc4d600c3cee05ca1e9192eb1d0e83b9ec2d69
• dotnet build -c Release: 0 warnings/errors
• dotnet test -c Release: 2,049 passed
• PowerShell file-header verification: passed
• OpenSpec strict validation: passed
• corpus PII audit: passed
• Slopwatch strict scan: 0 findings