hooks: permission gate should read the rewrite's own wrapper scan (follow-up to #4530) #4545

Summary

#4530 closed the #4126 regression (a denied command inside a shell wrapper the rewrite reaches now returns Defer) with the smallest change that is never worse than master. Three things were left on purpose. All rows below were verified on release binaries of master 0.51.0, develop 311ebcbf and #4530 with allow Bash(*) + deny Bash(git push:*) (rtk rewrite exit: 0 allow · 1 passthrough · 2 deny · 3 ask).

1. A rewritten prefixed script is auto-allowed on the outer rule

The host's outcome is unchanged (its own env:* rule allows the raw line), but RTK answers "allow" for a script it rewrote and only partly understood: the inner match reads past the prefixes the rewrite peels, not past a program's own options, and ask rules inside a script are not checked at all. At the segment start develop already refuses to auto-allow a wrapper (bash -c 'git status' → 3); behind a prefix it does not.

Proposed fix. Have the rewrite walk record what it did — the wrapper scripts it parsed, and whether it changed one — and let the gate read that instead of re-deriving positions. This is #3828's WrapperScan (07e17bab, @SindriFr), lost when #4126 superseded it. With it: Ask iff RTK actually rewrote inside a wrapper, deny and ask rules checked on exactly the scripts the rewrite saw, and the gate and the rewrite cannot drift by construction. Acceptance: #4530's test_shell_wrapper_positions_match_where_the_rewrite_reaches and test_wrapper_reached_by_the_rewrite_is_gated_for_deny_rules, plus a differential fuzz vs master and develop (prefixes inside scripts, \⏎ continuations, redirects glued to assignments, 40k-wrapper timing — the oracle used for #4530: equal to develop except Defer on a denied inner script, no new block or auto-allow vs master).

Plain prefixed denies (timeout 5 git push, env git push) are #4284's scope; it needs a rebase over #4530 (check_command_with_rules body moved to check_command_with_rules_and_prefixes, inner-script tests expect Defer).

2. Plain command with a redirect glued to an assignment

FOO=a>/dev/null git push → 0 on master, develop and #4530: split_for_permissions cuts the segment at the redirect (the gate sees FOO=a), while the rewriter's env peel swallows FOO=a>/dev/null and rewrites rtk git push. #4530 fixed this for wrappers only (lexer::split_for_wrappers); the rule gate's own split still cuts.

3. Continuation join changes semantics

collapse_line_continuations joins \⏎ with a space; bash removes it. sh -c "rm\⏎-rf x" is rewritten to sh -c "rm -rf x", a different command. Pre-existing on develop.

Decision recorded

#4530 returns Defer (no rewrite, no decision) rather than Deny on an inner-script match, so RTK never blocks where the raw command would run. Only Copilot JetBrains rendered #4126's Deny as a block; Gemini and Antigravity load no deny rules from RTK's side. Keep, or revisit together with the scan.

Refs: #4126, #3828, #4284, #4530, #4399.