Bash 'too complex' command handling reworked with a per-reason-kind table gating the outside-working-directory read block

When permissions.blockReadsOutsideWorkingDirectories is turned on (which makes file tools refuse reads outside your designated working directories), Bash commands that can't be reliably checked against that rule are refused. Previously this only applied to commands flagged as "too complex." Now a table of refusal reasons decides which ones trigger the same refusal, including: too-complex, semantics, multi-cd, shell-operators, cd-git-compound, and process-substitution. Other reasons, like dangerous-path, flag-validation, net-redirect, and sed-dangerous, are explicitly excluded.