Stop auto-allowing misparsed nested interpreter peels

[TheGreatAxios]

Summary

• Marks nested bash -c / interpreter peels opaque when tokenize degrades through escaped quotes (\bash) or splits the quoted body into unsafe trailing tokens, so auto cannot accept a leaf the peeler never fully saw.
• Caps peel depth by marking remaining nested wrappers opaque once MAX_PEEL_DEPTH is exhausted, instead of auto-allowing a truncated leaf.
• Adds regression coverage for single-level, double-nested, escaped triple-nested, and quote-broken deep nesting redirect payloads.

Verification

• bun run typecheck and bun run build pass (pre-commit)
• Targeted security / authz peel behavior covered by new CL-6988 cases in classify-security.test.ts

Fixes CL-6988

[linear-code]

CL-6988