pub fn enter_var(name: String, value: String) -> VarGuardExpand description
Bind name to a CERTAIN literal value (a VAR=/path assignment, or $1 at a function call)
for the duration of the guard; consulted by expand_vars AFTER loop vars, so the innermost/latest
binding wins. The caller binds only values it is certain of — an uncertain value (VAR=$(cmd),
VAR=$UNBOUND) is bound to the unpinnable sentinel so $VAR still fail-closes rather than
resolving to a stale or dropped value.