fix: address round-6 review by gating bash-semantics tests off the win32 lane and failing closed on nested Windows shells

R6-1: the whole-text divergent-syntax gate denied ~20 ungated bash-semantics
expectations on the real win32/cmd merge lane (41 failures reproduced under a
lane-spoof harness). Gate those blocks off the win32 non-bash lanes, splitting
mixed blocks so lane-safe pins keep running there, and commit the lane-spoof
harness so the whole guard suite runs as the win32/cmd merge lane on every
lane.

R5-1 (partial): cmd/powershell/pwsh invocations now fail closed on the
undecidable-payload denial on every lane — their payloads are parsed by a
grammar the POSIX text model cannot read (closes the -EncodedCommand and
nested cmd /c entrances probed at this head). The remaining class closure is
escalated to the maintainer as a product/scope decision.

Author: qwen-code-ci-bot