Add locked shell environment + centralized shell dialect guard for Bash tool

[mmprotest]

Motivation

• Prevent the runner from emitting or executing commands that are invalid for the active shell by detecting and locking the shell once per session and enforcing a small, token-based dialect guard at execution time.
• Implement a minimal, surgical set of high-frequency rewrites and conservative blocking to avoid broad command translation and keep behavior localized.

Description

• Detect and lock shell environment once per Runner session via detect_shell_environment(...) and store it on Runner._shell_environment, capturing os_family, shell_family, shell_exe, and cwd.
• Persist shell environment into session snapshots by adding shell_environment to SessionState and injecting it when SessionState is written (state_runtime._with_shell_environment).
• Wire locked shell state through the tool execution path by passing runtime_state={"shell_environment": ...} from execute_tool_with_lifecycle(...) into execute_tool(...) and _run_bash(...) so the guard runs centrally prior to subprocess invocation.
• Add a small shell helper layer in villani_code/shells.py providing ShellEnvironment, ShellCommandDecision, detect_shell_environment(...), and classify_and_rewrite_command(...) implementing simple token-based classification (allowed | needs_rewrite | blocked) and the minimal rewrite table:
  • cmd: rm <args> -> del /q <args>; grep pattern file -> findstr /n /c:"pattern" file; tail -n N file -> powershell -NoProfile -Command "Get-Content 'file' -Tail N".
  • powershell: grep pattern file -> Select-String -Pattern "pattern" file; tail -n N file -> Get-Content file -Tail N.
  • bash/zsh: leave native commands unchanged and conservatively block obvious cmd-only tokens.
• Enforce the guard inside _run_bash(...) (in tools.py) so blocked commands are not executed and needs-rewrite commands are executed after rewrite; _run_bash(...) now returns structured results including classification and uses the rewritten command for execution.
• When blocked, return compact structured payload JSON (compactness ensured via json.dumps(..., separators=(",",":"))) containing shell_family, classification=blocked, offending_pattern, short_reason, and optional suggested_equivalent.

Testing

• Added focused tests in tests/test_shell_command_guard.py covering: env detection returns a shell_family; cmd rm rewrite; cmd grep rewrite; cmd tail rewrite; cmd heredoc is blocked; powershell grep rewrite; bash-native command allowed; blocked commands return compact structured feedback.
• Ran python -m py_compile on the modified modules; compilation succeeded.
• Ran pytest -q tests/test_shell_command_guard.py tests/test_villani_control_loop_fixes.py; all tests passed: 30 passed in 1.47s.

---

Codex Task