Compose safe shell stages with approval grants

[Aaronontheweb]

Summary

• Let an independently safe shell stage compose with stored grants for the stages that still require approval.
• Show and persist only the candidates that need approval.
• Bind one-time retries to the exact prompted verb and effective-directory set across live, sub-agent, and recovered redrive paths.
• Remove sed -n from the Linux safe list because a sed program can still write files or execute commands.

Examples:

• cat input.json | jq .name now prompts only for jq. A matching jq grant allows the command.
• grep pattern input.txt | tee output.txt now prompts only for tee. A matching tee grant allows the command.
• External paths, dynamic syntax, malformed syntax, and hard-deny commands remain strict.

Security review

An adversarial review found two one-time retry gaps during development:

1. A directory could change to an external symlink after the prompt.
2. A clean glob could become unresolvable after the prompt.

The final implementation closes both gaps. A retry must match the original patterns and the exact filtered (verb, effective directory) set. The reviewer reran both probes and returned PASS with no blocking findings.

Verification

• dotnet build Netclaw.slnx -c Release --no-restore: 0 warnings, 0 errors
• Netclaw.Actors.Tests: 2,912 passed
• Netclaw.Configuration.Tests: 507 passed
• Netclaw.Security.Tests: 685 passed
• dotnet slopwatch analyze: 0 findings
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify: passed
• git diff --check: passed
• Synthetic workload PII scan: no findings

The repository does not currently provide the XPlat coverage collector, so the CRAP report could not be generated. No dependency was added to this security fix for that report.