Close the BareOS shell + Fish REPL roadmap tracker and ship the remaining

shell surfaces in-tree.
Roadmap / CI
- docs/data/shell-roadmap-features.json: all shell-001…shell-100 rows and
  P1–P8 phases marked implemented; note documents closure date and pointers.
- scripts/verify-shell-roadmap.mjs: validate JSON (schema 1, 8 phases,
  100 implemented items) plus existing source needles; wire npm run
  verify:shell-roadmap into root pretest (package.json).
- scripts/README.md: document verifier behavior.
Lexer & expansion (packages/bare-os-booter/lib)
- shell-lex.js: central lexShellLine; ANSI-C $'…' via decodeBareOsDollarQuote;
  keep diagnostics/tokenizer aligned with execution tokenizer.
- shell.js: stray reserved words at statement start → syntax error exit 2;
  optional [[ … ]] when BARE_OS_SHELL_DOUBLE_BRACKET=1 (==, !=);
  alias expansion before function dispatch (ordering tests);
  expandWordWithCmdSubst: balanced $(…) vs skipped $((…)); backtick
  command substitution when BARE_OS_SHELL_CMDSUBST; default ctx.execLine for
  nested cmdsubst when unset; index passthrough for DOUBLE_BRACKET env.
- shell-glob.js: ~login → HOME when USER matches, else /home/login (bounded
  login pattern); tests for pathname + execShellLine.
- shell-tokenizer.js: align with shell-lex detailed spans/modes where needed.
Completion / REPL
- completion-engine.js: completion depth / collectors per shell program work.
- packages/bare-os-booter/index.js: small wiring for shell env passthrough.
/bin/sh front-end
- packages/bare-os-coreutils/src/sh.js; kernel/bin/sh; seeder copies: stay in
  sync with shell behavior and env flags.
Tests
- packages/bare-os-booter/test.js: coverage for misplaced reserved words,
  gated [[ ]], alias vs function, ~user/~~ paths, $'…', cmdsubst $(…) and
  backticks, and related regressions.
Documentation
- docs/reference/shell-grammar.md: $'…', $(…) / backticks vs $((…)).
- handbook/09-posix-utilities-shell-and-vfs.md, environment appendix,
  shell-troubleshooting / shell-unsupported-behavior, release checklist,
  docs/reference/README.md: shell behavior and operator surfaces.
- developer-guide/19-how-to-fish-keybinding-completer.md: Fish keybinding /
  completer how-to (new).
Generated / synced artifacts
- kernel/lib/bare/manifest.json, kernel/share/man/man.json,
  kernel/lib/bare/shell-completion.json, posix_utilities.json,
  docs/audit/bundle-health.json: regenerated or synced with tooling.
- scripts/bench-shell-phases.mjs: bench script touch.

docs/reference/shell-unsupported-behavior.md

@@ -10,6 +10,12 @@ BareOS shell aims for practical POSIX-like behavior, not full `sh` compatibility
 - Signal delivery and trap timing prioritize deterministic guest behavior over host parity.
 - Arithmetic/expansion are bounded for memory safety and predictable failure modes.
 - Optional sandbox/policy mode can deny commands by name (`BARE_OS_SHELL_SANDBOX`, `BARE_OS_SHELL_DENY_COMMANDS`, `BARE_OS_SHELL_ALLOW_COMMANDS`), which intentionally differs from stock POSIX shells.
+- **`select`** is unsupported (explicit error).
+- **`[[ … ]]`** extended tests are off by default (use **`[`** / **`/bin/test`**). With **`BARE_OS_SHELL_DOUBLE_BRACKET=1`**, only binary **`==`** / **`!=`** between two words is supported.
+- **`globstar` (`**`)** is opt-in via **`BARE_OS_GLOBSTAR=1`** and remains bounded by **`BARE_OS_GLOBSTAR_MAX_DEPTH`** to avoid runaway recursion.
+- **`( compound-list )`** grouped execution requires **`BARE_OS_SHELL_POSIX_MODE`** or **`BARE_OS_SHELL_GROUPING`**; it is **not** a forked subshell (no variable or working-directory isolation from POSIX subshells).
+- Brace expansion **`{a,b}`** cross-products are capped by **`BARE_OS_SHELL_BRACE_EXPANSION_MAX`** (see environment appendix) to avoid combinatorial blowups.
+- **Process substitution** **`<(…)`** / **`>(…)`** is rejected at parse time (**exit 2**). **`{var}>&`** / arbitrary **`{n}>&`** fd dup forms beyond documented **`2>`** / **`2>>`** / **`2>&1`** are unsupported.
 
 ## Why this is explicit