fix(tools): harden shell command pattern-matching against flag-order and blocklist bypasses

[bug-ops]

Summary

• Generalizes the tokenized recursive/force-flag detector already used for .git/worktrees protection (is_blocked_rm_worktrees) to the general root/home rm guard, closing bypasses via reordered (-fr), separated (-r -f), long-form (--force), and post-path flags (rm / -f). Restores the original literal substring patterns in DESTRUCTIVE_PATTERNS alongside the new detector as belt-and-suspenders coverage for chained (cd /tmp && rm -rf /), prefixed (sudo rm -rf /), and non-rm-anchored invocations the tokenized detector alone can't see.
• Expands the sub-agent NetworkScope::Deny / allow_network = false blocklist (NETWORK_COMMANDS) from 5 to 16 entries, covering ssh/scp/rsync, openssl s_client, socat, common interpreter one-liners (python3 -c, perl -e, ruby -e), and bash's /dev/tcp//dev/udp pseudo-devices via a new embedded-substring fallback matcher.
• Unifies ShellExecutor::find_blocked_command (the real bash-execution dispatch path) with check_blocklist's matching logic via a shared match_blocklist_tokens helper — these had drifted into separate, unsynchronized implementations, so the hardening above now reaches the actual bash tool dispatch path, not just external callers like NetworkDenyToolExecutor/ACP terminal.
• Doc comments on NETWORK_COMMANDS and NetworkDenyToolExecutor now honestly disclose residual, out-of-scope bypass vectors (flag-insertion before -c/-e, versioned interpreter names, non-transparent wrapper commands) rather than implying full coverage.

Closes #6497
Closes #6473

Test plan

• cargo +nightly fmt --check — clean
• cargo clippy --profile ci -p zeph-tools -p zeph-subagent --all-targets -- -D warnings — clean, 0 warnings
• cargo nextest run --config-file .github/nextest.toml -p zeph-tools -p zeph-subagent --no-fail-fast — 1955/1955 passed (22 new tests)
• cargo test --doc -p zeph-tools — 34/34 passed
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps -p zeph-tools -p zeph-subagent — clean
• gitleaks protect --staged --no-banner --redact — no leaks
• New regression tests cover every bypass vector from both issues' reproduction steps, including a follow-up round after an adversarial critique caught a coverage regression (chained/prefixed/recursive-only-on-syspath/home-subpath rm forms), with negative tests confirming no over-broad false positives (rm -f /tmp/x.log, openssl enc ..., relative paths all still allowed)