t-7 FUZZ-040: shell-quote graph recovery commands

[randlee]

Fixes comp-t-7.15 (f8fde08 -> 1f37cde). Rebased by the stack writer onto the linear phase-t top. At the top: clippy -D warnings clean, cargo fmt clean, codespell clean, workspace tests 1062 passed, 0 failed.

🤖 Generated with Claude Code

[randlee]

QA fix verification: comp-t-7.15-qa (FUZZ-040) at 1f37cde

Verdict: FAIL. 1 carried finding still open.

Finding	Disposition
fuzz-040	open (partial fix)

Fixed: the original repro. Ids are single-quoted, so $(id) and ; no longer execute; an embedded ' is handled; normal ids stay valid shell (now quoted, so not byte-identical to before; expectations were updated).

Still wrong:

• Control characters go in $'...' using str::escape_default, which emits \u{7}. Bash does not parse that: printf '%s' $'a\u{7}b' prints the literal a\u{7}b, so the pasted argument is not the real id (reproduced by quality-mgr and the coordinator).
• Bidi override/isolate characters (U+202E, U+2066, ...) are category Cf, not Cc, so char::is_control is false and they reach the terminal raw. The finding says they must be escaped (read from the code; no bidi input was run).
• The regression test only unit-tests shell_quote on two strings. It never drives missing_edge_commands or the CLI text path with a hostile id, and has no bidi case.

Round 2 poured as comp-t-7.fuzz-040-r2-fix / -sanity / -qa.

Disclosures: CI not checked (rate-limit rule). Verified by the fuzz coordinator with no real bd. The finding is developer-filed, so the verifier was hand-locked to the bead deliverables (fix-round-scope cannot read it, known tool gap). The test was not run against the baseline (it calls shell_quote, which does not exist there).