refactor(core): inline portable shell scanner

[kitlangton]

What

Moves the portable shell scanner from the unpublished @opencode-ai/shell-scan workspace package into Core, where it is consumed.

This removes an unpublished package from Core's runtime dependency graph without changing scanner behavior or the experimental feature's opt-in status.

How

• Moves the scanner implementation to packages/core/src/shell/scan.ts.
• Moves the scanner regression corpus to packages/core/test/shell-scan/.
• Updates Core's lazy runtime import and parity test to use the local module.
• Removes the standalone package, lockfile entry, Core dependency, and root publish step.

Scope

• No scanner behavior changes.
• No permission wire-contract changes.
• experimental.portable_shell_scanner remains opt-in and defaults to false.
• Scanner hardening remains in fix(core): harden portable shell authorization #44016 and will be rebased onto this relocation.

Testing

• bun install --frozen-lockfile
• bun run test test/shell-scan test/shell-parse.test.ts test/shell-parse-parity.test.ts test/tool-shell.test.ts from packages/core
• bun run test from packages/core: 2,220 passed, 16 skipped
• bun typecheck from packages/core
• bun run build from packages/core
• bun run lint from the repository root: 0 errors, existing warnings only
• Push hook repository typecheck: 32 successful packages
• bun pm pack from packages/core, verifying dist/shell/{parse,scan}.js and matching declarations are included