[codex] Add private shell AST command view helpers

[Fieldnote-Echo]

HUMAN:

• A human has tested these changes.

AGENT:

---

Why

PR-D scaffold for #2721 adds a private syntax-view layer before the behavior-changing detector migration. The goal is to give the next PR a typed, byte-offset-safe view over tree-sitter-bash commands, words, and pipelines without changing current analyzer behavior.

Summary

• Added private openhands.sdk.security._shell_ast dataclasses and helpers for shell programs, words, commands, and pipelines.
• Added command traversal, pipeline stage extraction, POSIX command basename, short/long flag, and key-value word helpers.
• Kept detector behavior, public exports, serialization fields, dependencies, and UNKNOWN semantics unchanged.

Issue Number

#2721

How to Test

I validated the scaffold locally with the following commands:

• make build
• uv run pre-commit run --files openhands-sdk/openhands/sdk/security/_shell_ast.py tests/sdk/security/test_shell_ast.py
• uv run pytest tests/sdk/security/test_shell_parser.py tests/sdk/security/test_shell_parser_node_shapes.py tests/sdk/security/test_shell_ast.py
• uv run pytest tests/sdk/security/defense_in_depth/test_serialization.py tests/sdk/security/defense_in_depth/test_shell_parser_bypasses.py

The parser-focused suite passed with 113 tests. The defense-in-depth suite passed with 23 tests and 7 strict xfails, preserving the current bypass-test expectations. Because this PR only adds a private SDK parser-view scaffold and does not change runtime detector behavior or UI behavior, there is no separate manual product flow to exercise in this PR.

Video/Screenshots

Not applicable. This is a private SDK refactor scaffold with no UI surface.

Type

• Bug fix
• Feature
• Refactor
• Breaking change
• Docs / chore

Notes

This is the PR-D scaffold only. Behavior-changing detector migration, recursive bash -c parsing, ANSI-C decoding, command-substitution evaluation, ActionEvent extraction, parse caching, and public helper promotion are intentionally left out of scope.