Bash-tool / printf safety hardening

The Bash command analyzer now rejects printf invocations that could execute arbitrary code via format-string substitution: printf arguments containing $, \u/\U escapes, format specifiers paired with non-numeric runtime values, or any flag other than the literal -- are no longer auto-allowed.

For double-bracket arithmetic, the diagnostic now points out that bash may run $(cmd) while reusing [['s semantics: ' contains array subscript or runtime-determined value — bash evaluates $(cmd) in subscripts and ...' operand is non-numeric — \[[\ arithmetically evaluates identifiers/subscripts (may run $(cmd)).

A new escape-line-continuation rule replaces the older one to handle even-vs-odd backslashes correctly when deciding whether a backslash-newline pair is a real line continuation.