pub fn scan(command: &str) -> BashScan
Scan a bash command into (patterns, always), matching upstream shell.ts: each subcommand is a pattern; its arity prefix + “ *“ is the always grant.