Function assert_single_statement 

pub fn assert_single_statement(
    command: &str,
    allow_shell_probe: bool,
) -> Result<()>

Validate that command is a single top-level bash statement.

allow_shell_probe controls the tree-sitter-error fallback: when the embedded grammar flags an error, we can ask the real bash -n -c whether the syntax is actually valid (the grammar lags real bash). That spawns a shell on the request path, so it’s gated to trusted (wcgw) mode only — in restricted modes (code_writer/architect) we must not spawn bash to vet a command, so tree-sitter’s verdict is final there.