Fix/lru eviction and effective fingerprint - #8

Every rule read POSIX shell. An agent driving a Windows host — which is what
OpenClaw turned out to be — writes `Remove-Item -Recurse -Force C:\` for what
`rm -rf /` means, and that scored 0. So did Format-Volume, diskpart clean, and
`iwr | iex`.

This is not a gap to schedule. The vocabulary mismatch is currently masking it:
every OpenClaw call is hard-denied as `tool not allowed`, including the
dangerous ones, for the wrong reason. Mapping `exec` to `shell` — the agreed
next step — retires the tool gate and hands evaluation to content rules that
only understand POSIX. The agent would go from "everything refused" to
"PowerShell destruction allowed at risk 0" in one commit, with nothing to
signal it. So this lands first.

Three properties the POSIX rules did not have to handle:

- Cmdlets have aliases, and `rm`, `del` and `rd` are among them.
- Parameters abbreviate to any unambiguous prefix: `-Recurse` is also `-rec`
  and `-r`, so matching the full word misses what an agent actually writes.
- The shared normalizer strips backslashes before non-space (it exists to
  defeat `r''m -rf /`), so `C:\Users\rober` arrives as `c:usersrober` and
  patterns cannot depend on path separators.

Root-target required, exactly as in the POSIX rule. `Remove-Item -Recurse
-Force .\build` is the most common thing an agent does; a rule that fires there
makes the guard unusable on Windows, which is worse than not having it. Five
such cases are in the benign corpus.

15 evasion cases covering alias, abbreviation, flag order and case; the security
baseline moves only in the benign count, with allowed == total. Benchmarks
unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>