Expand policy fuzzing corpus

[Eilen6316]

Goal

Broaden policy parser fuzzing beyond the initial shell-structure tests so regressions in command parsing, LOLBin detection, and policy merging are caught earlier.

Context

v4.1.0 introduced Hypothesis fuzzing for shell-structure parsing. The next step is to expand the generated corpus around known bypass families and policy invariants.

Scope

• Add generated cases for quoting, escaping, nested substitutions, and malformed shell syntax.
• Add LOLBin-oriented generation for find, xargs, awk, sed, shells, and interpreters.
• Add invariants such as parse failures must not become SAFE for LLM-sourced commands.
• Add regression seeds for historical red-team cases.
• Keep fuzzing runtime bounded for CI.

Non-goals

• Do not replace hand-written red-team cases.
• Do not depend on a live shell or external commands for safety tests.
• Do not mock the policy engine in security tests.

Acceptance Criteria

• Fuzz tests run within the normal unit-test budget.
• Known red-team bypass families are represented as generated or seeded cases.
• Failures produce reproducible examples.
• make test and make red-team pass in CI.