fix: enforce wrapped bash rules and scrub provider credentials

[hetaoBackend]

Change

A transparent wrapper such as nohup npm publish could evade deny npm publish:* while matching allow npm:*. Deny, ask and allow rules now share the same raw and wrapper-stripped command matching, preserving their precedence in default, auto and bypass static evaluation.

Permission rule updates retain the host-owned isFile probe so local-script classification does not change after a grant or revocation. Bash environment scrub also removes MCODE_PROVIDER_API_KEY and its INPUT_ alias. The scrub list remains precise: custom key names, provider model/URL settings and legitimate GH/npm tokens keep their existing behavior; off mode and strict allowlist semantics are unchanged.

Closes #150. Closes #151. Closes #153.

Validation

• Reproduced all three reports before the fix: 82 failures and 24 passes across the new regression tests.
• Focused regression tests: 106/106 pass after the fix, including wrapper chains, environment prefixes, compound commands, exact/prefix/wildcard/whole-tool rules, all three static evaluation modes, all three context rule-update operations, CI-selected scrub and the spawn hook.
• git diff --check and pnpm check:source: PASS.
• pnpm verify full profile: PASS on clean committed HEAD 0e68219ba442ae55a3172c8a8da425bd6b4ce386, macOS arm64, Node 26.4.0 (84 seconds). All 14 gates passed, including 3,495 capability tests, 115 permission-facade tests, 48 sandbox tests, source export, typecheck, build, artifact checks, smoke and offline BYOK. The release-tools suite reports its existing platform-specific skip (20 passed, 1 skipped).
• NOT RUN locally: Linux/Windows execution and live-provider acceptance. Tests use synthetic values and do not execute the sample npm commands. Custom --api-key-env names remain outside the fixed scrub list.

Publication and contribution checks

• I have permission to contribute these changes under the existing licenses applicable to the changed files/packages; existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included.
• Added test files were reviewed before regenerating release/public-source.json; both are declared in test/vitest-suites.json for the cross-platform capability gate.
• No CLI flags or shared English/Chinese documentation changes are required. Offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope: two regression test files only; no license changes.

Shared-source port: pending.