v1.18.17: Shell permission bypass hardening

Highlights

• Harden Bash read-only permission checks against dynamic path expansion, process substitution, sensitive environment expansion, and mutating options on otherwise read-oriented commands.
• Share static shell normalization and Windows-aware path containment between Bash permission checks and HITL classification.
• Tighten sensitive path detection for quoted, escaped, globbed, brace-expanded, ANSI-C quoted, and procfs argument/environ access patterns.
• Add parameter-level safety checks for find, tee, sort, uniq, file, git branch/tag/remote/output, date, and hostname usage.
• Expand Unix and Windows regression coverage, stabilize hook descendant cleanup coverage, and add PHP 8.3 to the CI matrix.

Validation

• GitHub Actions tag CI passed for v1.18.17: https://github.com/skvdhshuk-blip/hao-code/actions/runs/30638246940
• Packagist indexes v1.18.17 at 1c3724a.