fix(analysis): flag arithmetic command substitutions

[chaliy]

Motivation

• The analysis walker ignored WordPart::ArithmeticExpansion, letting runtime $() inside arithmetic expressions execute hidden commands without being reported.
• This allowed scripts like echo $(( $(rm -rf /data; echo 1) + 2 )) to appear non-opaque and bypass pre-execution permission prompts, violating the analysis security contract.

Description

• Mark arithmetic expansions that contain $(...) as substitutions by setting has_command_substitution and conservatively setting has_dynamic_commands in walk_word_parts of crates/bashkit/src/analysis.rs so is_opaque() becomes true.
• Add a regression unit test analysis::tests::command_substitution_in_arithmetic_is_opaque that asserts arithmetic-embedded $(...) is reported and makes the analysis opaque.
• Update the knowledge/integrations/script-analysis.md and knowledge/security/threat-model.md guidance to document arithmetic-embedded command-substitution behavior and the mitigation for TM-ESC-032.

Testing

• Ran cargo test -p bashkit analysis::tests::command_substitution_in_arithmetic_is_opaque --lib which passed.
• Ran the suite cargo test -p bashkit analysis::tests --lib which passed (all modified analysis tests succeeded).
• Ran style and policy checks cargo fmt --check, cargo clippy --all-targets -- -D warnings, and just check-okf which completed successfully.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	67d6765	Commit Preview URL	Aug 07 2026, 09:30 AM