param-op: one substitution-spec splitter, not two (#684)

[berrym]

Closes #684.

The defect

${v/p/r} and ${arr[@]/p/r} take the same pattern/replacement spec, so they must split it the same way. The per-element dispatch carried its own copy of that split, and the copy had drifted — its no-separator branch skipped the \/ → / canonicalization:

$ lush -c 'v=a/b/c; arr=(a/b/c); printf "<%s><%s>" "${v//\/}" "${arr[@]//\/}"'
<abc><a/b/c>                    # bash: <abc><abc>

The element path now calls lush_param_op_split_substitution_spec — the function the scalar path already used, exported from param_op.c — and the duplicate is deleted. One spec, one splitter.

The code carried a comment naming this exact divergence and #684, noting the fold "belongs in its own commit". This is that commit. It is also the consolidation the expansion arc exists for: param_op.c is the shared core that both the legacy expander and the word CST call, so the fix lands once for both routes.

Two pre-existing defects found while verifying (filed, not folded in)

Both byte-identical against a build of the parent commit:

• a per-element operator collapses "${arr[@]}" to a single field #749 — a per-element operator collapses "${arr[@]}" to one field where bash and zsh give N. The element values are correct and this fix corrected them (<a/b x/y> → <ab xy>); the field boundary is lost separately and affects #, %, ^^, // alike. cp "${files[@]#./}" dest passes one argument instead of N.
• the replacement half of ${v/pat/repl} is not unescaped #750 — the replacement half is never unescaped, so ${v//X/\/} yields a\/b where bash and zsh give a/b. Consistent on both paths: they now agree, they simply agree on the wrong replacement.

Verification

• tests/integration/test_vector_substitution_spec.c — 17 checks. Twelve compare the scalar and element results against each other as well as against a literal, so a future change that breaks both in the same way still fails. The rest cover the vector, joined and positional forms.
• 4 of 17 fail against the parent build.
• Full suite 197/197. ASan 65/65; the new test 1/1 under ASan.

Field count is deliberately not asserted here — that contract belongs to #749, and asserting today's collapsed behavior would lock in the defect.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!