Detects OAuth device code flow output that must not be compressed.
Uses a two-tier approach: strong signals match alone (very specific to
device code flows), weak signals require a URL/domain in the same output.
Compresses shell command output using the unified compression pipeline.
Delegates to the same exit-code-aware logic used by the CLI, so a failed
command (exit_code != 0) is preserved verbatim and successful output is
compressed consistently (excluded_commands, structural routing, terse). #810.
Detects shell redirect operators (> or >>) that write to files.
Ignores > inside quotes, after a backslash escape (\" must not toggle
quote state, \> is a literal), 2> (stderr), /dev/null, and
comparison operators.
#848: temp directory targets are read-back, not persistent writes.
#848/#989: targets that are NOT persistent project-file writes.
Redirecting to temp dirs, /dev/* devices, or paths containing shell
variables (which we cannot resolve at parse time) is output capture,
not file authoring.