fix(security): batch 1 — issues #488-#492

[chaliy]

Summary

Fixes 5 security issues from the 2026-03 audit (batch 1 of 3):

• security: declare/readonly/local/export bypass is_internal_variable() (TM-INJ-012–015) #488: declare/readonly/local/export bypass is_internal_variable() guard (TM-INJ-012–015)
• security: _ARRAY_READ_ prefix not protected by is_internal_variable() (TM-INJ-016) #489: _ARRAY_READ_ prefix not protected by is_internal_variable() (TM-INJ-016)
• security: set and declare -p leak internal marker variables (TM-INF-017) #490: set and declare -p leak internal marker variables (TM-INF-017)
• security: arithmetic compound assignment panics on overflow (TM-DOS-043) #491: Arithmetic compound assignment panics on overflow (TM-DOS-043)
• security: lexer stack overflow on nested $() in double-quotes (TM-DOS-044) #492: Lexer stack overflow on nested $() in double-quotes (TM-DOS-044)

Changes

• Added is_internal_variable() guards to all builtin variable insertion paths
• Extended is_internal_variable() with _ARRAY_READ_ and _EVAL_CMD
• Filtered internal markers from set and declare -p output
• Replaced native arithmetic operators with wrapping_* variants in compound assignment
• Added depth tracking to lexer read_command_subst_into()
• Un-ignored 12 security regression tests that now pass

Test plan

• All 12 security audit regression tests pass
• Full test suite passes (cargo test --all-features)
• cargo fmt --check clean
• cargo clippy --all-targets --all-features -- -D warnings clean

Closes #488, closes #489, closes #490, closes #491, closes #492