fix(code-placeholders): reject shell arithmetic placeholders - #8628

Summary

• Reject resolved shell placeholders inside $((...)), $[...], and ((...)) (including arithmetic for headers) before sandbox execution, where Bash recursively evaluates operand text.
• Track these explicit arithmetic frames and their nested substitutions in the shared placeholder compiler. Preserve literal shell text and analysis-only variable discovery.
• Scope: this is a defense-in-depth syntax guard, not a complete prohibition on evaluating bound data. let, numeric [[ ... ]] comparisons, array subscripts, integer assignments, and values assigned elsewhere before arithmetic evaluation remain outside this change. The demonstrated path uses environment values available to the shell author; no additional privilege boundary is crossed.

Type of Change

• Bug fix

Testing

• All 13 arithmetic rejection cases fail with the guard removed.
• Compiler, resolver, and Function execution tests: 316 passed on the staging base.
• bun run lint, bun run type-check, all 58 repository audits, docs-manifest check, and the staging-based block-registry check passed.
• Full repository test run on Node 24: app suite had 34,713 passes and one timeout in the existing executor/execution/executor.test.ts case "does not run a stale branch inside a loop"; all 18 other test tasks passed. The timeout also reproduces with this patch removed on clean staging.
• Local compiler-to-Bash reproduction verified before the fix and rejected after it; no hosted sandbox run.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)