'tee' is now a recognized, sandboxed shell command

What

• tee is now implemented as a supported shell builtin in the sandbox, piped through the existing sha*sum-style handler, and classified as a write permission; special device targets (/dev/null, /dev/stdout, /dev/stderr, /dev/tty) are filtered out of its arguments before permission checks run.
• The command path-validator now special-cases tee: a tee call with no target paths passes immediately ("Path validation passed for tee command") instead of going through the usual working-directory restriction logic.
• The basename-normalizing helper used to detect file-affecting shell commands (previously only rm/rmdir) now also matches tee, case-insensitively and with a .exe suffix stripped.
• tee was added to the bash-command-summary descriptions, described as "write to files in".

Why Previously tee wasn't recognized as a file-writing command, so it could bypass the usual write-permission and working-directory checks or produce confusing summaries; now it's treated consistently with other file-writing commands.