fix(agent-guard): scope Segment.raw to its own tokens, not the whole command

[AmirF194]

split_segments() builds every Segment in a compound command as Segment(current, command), passing the whole input string as raw regardless of which segment it is. guard_commit_trailer searches seg.raw for co-authored-by:, so it was really searching the entire line, not the commit's own message. A git commit with a clean message gets denied if an unrelated earlier segment (a comment, a grep, an echo) happens to contain that phrase.

Fixed by giving each segment raw = shlex.join(current), a reconstruction of that segment's own tokens only. It still supports the heredoc-survival case the docstring describes: shlex.split doesn't parse << specially, so a heredoc's delimiter and body just become ordinary tokens attached to the segment they trail, and shlex.join puts them back as one searchable string. Checked the field's only other reader, GuardContext.raw: none of the four guards.d/skill-contributed guards use it, so the fix's blast radius is exactly the one guard this issue is about.

Added test_compound_command_other_segment_not_denied, the new test breaks without the change and passes with it. Full tools/agent-guard suite (92 tests), ruff, ruff format and mypy all come back clean in a python:3.11-slim container.

Fixes #1150