Require general shell approval analysis

[Aaronontheweb]

Summary

• prohibit executable-specific parsing in Netclaw shell approval code
• require general syntax, control-flow, value, path, and authority facts
• keep unresolved input strict when ShellSyntaxTree lacks a general fact
• preserve explicit safe-verb and hard-deny lists as policy data

This is a constitution-only change. No runtime code changed.