Promote PowerShell value and state analysis

[Aaronontheweb]

Summary

• promote PowerShell value and state analysis across command identity, cwd, HOME/environment values, redirects, aliases, scripts, execution regions, and decoded child hosts
• require an explicit constrained initial-state assertion before command binding can become authorization proof, while preserving v0.2 compatibility leaves
• keep unproved identities and state fail-closed; unknown-receiver non-pipeline bodies remain visible and incomplete, while unproved interior pipelines fail atomically
• preserve cmdlet/native binding provenance through static current-scope Invoke-Expression cloning without leaking that proof into isolated child hosts
• expand the generated PowerShell corpus from 422 to 491 entries and synchronize the canonical spec, OpenSpec, implementation plan, project context, and consumer guide

Security boundaries

• PowerShell aliases may shadow built-ins and path-shaped names
• decoded pwsh children do not inherit the parent runspace's constrained-state assertion
• uncontrolled child profiles do not inherit exact HOME or USERPROFILE facts
• uninspected scripts and unproved invocations invalidate following observable authorization state
• partial pipeline authorization remains prohibited

Validation

• adversarial review: PASS
• dotnet build -c Release: clean, 0 warnings
• dotnet test -c Release --no-build: 2,765/2,765
• projection tests: 211/211
• corpus, design corpus, PII audit, and PowerShell oracle: 791/791
• public API snapshots: 40/40
• exact 491-entry corpus regeneration: clean
• openspec validate v0-3-structured-shell-analysis --strict: valid
• header verification: clean
• Slopwatch: 0 findings
• git diff --check: clean