Worktree git-isolation guard now analyzes complex shell trees, not just simple commands

The worktree git-isolation guard, which blocks git commands from escaping an isolated worktree, no longer refuses every non-simple shell command outright. It now parses complex commands (subshells, pipes, etc.) into an AST and only refuses when the command is unparseable, contains an error node, or a regex flags the git invocation as too complex to verify; otherwise it walks the parsed tree looking for actual worktree-escaping redirection.