fix(interpreter): split command substitution output on IFS in list context

[chaliy]

Summary

• Fix word splitting for unquoted $() command substitution in list contexts (e.g., for x in $(cmd))
• Previously, the entire command substitution output was treated as a single token; now it is split on IFS characters (space/tab/newline by default)
• Add 3 spec tests covering for-loop with find, space-separated words, and newline-separated output

Details

The root cause was in expand_word_to_fields() in crates/bashkit/src/interpreter/mod.rs. For words that weren't array expansions, it called expand_word() which returns a single concatenated string, then wrapped it in a single-element vec. There was no IFS-based field splitting step for unquoted command substitutions.

The fix checks if the word is unquoted and contains a CommandSubstitution part. If so, the expanded result is split on IFS characters (defaulting to space/tab/newline), with consecutive whitespace collapsed and empty results elided. This matches POSIX shell semantics and real bash behavior.

Test plan

• Added 3 new spec tests in command-subst.test.sh (for-loop splitting, space splitting, newline splitting)
• All 1308 bash spec tests pass (1184 passed + 124 skipped, 0 failed)
• 1084/1084 bash comparison tests match real bash (100%)
• cargo fmt --check clean
• cargo clippy --all-targets --all-features -- -D warnings clean
• Unit tests and threat model tests pass

Closes #347