feat(shell): implement command substitution (Phase 6 M6)

- Add $(cmd) and `cmd` syntax support
- Parse command substitutions in tokenizer (nested $() supported)
- Execute commands and capture stdout during expansion
- Strip trailing newlines (POSIX behavior)
- Support command subs in double quotes, literal in single quotes
- Add expand_with_command_sub() combining variables + command subs
- Update External and Pipeline execution to expand command subs
- Add 12 new unit tests for command substitution parsing

Test results:
- Unit tests: 82 passed (+12 new command sub tests)
- Integration tests: 27 passed
- Property tests: 19 passed
- Total: 128 tests passing

Supported commands in command substitution:
- External commands (any executable)
- pwd builtin
- ls builtin

Known limitations:
- Pipeline command substitution not supported ($(cmd1 | cmd2))
- Builtin commands with state changes not supported

BREAKING CHANGE: expand_with_command_sub() requires &mut ShellState

Ref: docs/PHASE6_M6_DESIGN.md, docs/SESSION_2026-01-29_COMMAND_SUB.md

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: hyperpolymath