docs: specify structured shell approval policy

[Aaronontheweb]

Summary

• records the sanitized D01-D18 beta approval harvest and shared ownership classification
• replaces the proposed maze of shell-policy branches with one typed, per-candidate coverage pipeline
• preserves real ownership: invocation attempt for one-time keys, approval actor for session/persistent grants, session pipeline for pending/recovery
• specifies token-boundary grants, an immutable reviewed safe catalog, bounded causal Bash intent, and a redacted decision trace
• adds exact executable policy fixtures for D02, D03, D07-D11, D14, D17, and D18
• retains the boundary that ShellSyntaxTree supplies facts while Netclaw owns authority, with no executable-private command parsing

Decisions required before implementation

• approve Netclaw consuming ShellSyntaxTree's opt-in pre-field-splitting AuthoredValue for approval matching
• choose whether simple v2 grants gain token-prefix authority during schema-3 migration or remain exact until re-approved

Validation

• openspec validate structure-shell-approval-policy --type change --strict --no-interactive
• shared evidence is byte-identical with the ShellSyntaxTree proposal
• exact fixture/schema, candidate/trace ordering, and final-outcome checks passed
• current ShellSyntaxTree CLI replay confirmed fixture candidate phrases
• PII audit and manual review passed
• git diff --check
• adversarial review: PASS

Docs/OpenSpec only; implementation and behavior remain unchanged in this PR.