Preserve execution provenance across shell and jobs

Track ordered shell reassignment and positional taint, static evaluator aliases, env-prefixed Git and Node loaders, runtime option operands, heredoc programs, AWK and sed sources, cumulative make directories, tar aliases, current-run artifact reuploads, and BuildKit RUN mount images. Add focused unsafe fixtures and safe overwrite coverage.

Author: VladimirBrejcha