gate: irrecoverable allows IFS splitting, variable-held verbs, mkfs and chmod -R 777 #336

hooks/gates/irrecoverable.py allows four destructive shapes that it should deny. I reproduced each against develop by piping a PreToolUse payload into hooks/gates/irrecoverable.sh, with MH_GATE_JOURNAL_PATH pointed at a scratch file:

The first two rows are controls. A grep of irrecoverable.py finds no IFS, mkfs or chmod handling.

These were found by reading third-party Claude Code mods (aitmpl security/jev-auto-mode rules.ts:407-560, security/block-destructive-commands) during the #323 research. jev-auto-mode reads each command part twice, as written and as the shell runs it: quotes dropped, $IFS read as a space, wrappers stripped, same-line assignments read back. A program known only at run time ($X, source) gets an "ask" floor instead of a pass.

Fix direction

1. Normalize $IFS / ${IFS} (and $IFS$9-style forms) to a space before tokenizing.
2. Read back same-statement and earlier same-line assignments (X=rm; $X …, X=rm && $X …) before the verb check. Where the verb stays unknown ($X with no visible assignment, source <file>), apply an ask floor rather than allow, matching the existing ask path used for gh pr merge.
3. Add patterns: mkfs* / mkfs.*, chmod with 777 or a+rwx on /, ~ or -R, and rm --no-preserve-root.
4. Fuzz per docs/reference/repo-gotchas.md, like gate: zsh runs a brace group with no space after the open brace, which the subagent guard does not see as a command start #318. Watch for false positives on harmless X=1; echo $X.

Related: #49 (closed) was the same indirection class in convergence-merge-gate.sh.

Acceptance: the four rows deny (or ask, for the opaque-variable case) in tests/. Each new test is red on current develop. Existing gate tests stay green.