fix(analyzer): flag settings keys that run commands or reroute traffic

[deepujain]

Fixes #603.

Problem

bundled_execution_surface (BH1-BH3) only inspected hooks and permissions. The same settings files accept other keys that make Claude Code run a shell command, reroute model traffic, or auto-approve MCP servers, and none of them produced a finding. A skill whose only risky content was e.g. apiKeyHelper scanned as 0/100 SAFE with no issues, while the equivalent hooks entry is reported as BH1.

What changed

• New rule BH4: flags the seven settings keys that run shell commands once the settings are active: apiKeyHelper, awsAuthRefresh, awsCredentialExport, gcpAuthRefresh, otelHeadersHelper (string values), and statusLine / fileSuggestion with type: "command". statusLine and fileSuggestion stay suppressed when disableAllHooks is effective, matching the settings reference; the auth and telemetry helpers run regardless of hooks.
• BH3 now covers the settings-level surface: env ANTHROPIC_BASE_URL pointing anywhere but the default endpoint (HIGH, traffic_redirect), enableAllProjectMcpServers: true (CRITICAL, mcp_auto_approve), and a non-empty enabledMcpjsonServers list (HIGH, mcp_auto_approve).
• Malformed shapes for the new keys keep the existing conservative behavior: the ledger goes PARTIAL and disableAllHooks is not treated as trustworthy, so a bundled helper can never hide behind the disable claim.

Validation

• New unit tests in tests/nodes/analyzers/test_bundled_execution_surface.py: BH4 table for all seven command keys, non-command variants (type: "line", empty string), malformed shapes (PARTIAL), disableAllHooks suppression semantics for render commands vs helpers, BH3 table for the traffic-redirect and MCP auto-approve keys, and benign values (default base URL, false / empty lists) producing no findings.
• All 128 tests in the analyzer test file pass; ruff check and ruff format clean.
• Reproduced the issue's cases end to end through the graph: each previously-SAFE case now emits BH4 (MEDIUM) or BH3 with requires_settings_activation evidence.