9aa0721b23
Runbook prose inside a quoted-delimiter heredoc feeding a data sink (cat > file <<'EOF') is documentation, not a command this shell will execute. Mask provably-inert heredoc bodies (tools/shell_heredoc's conservative stripper, already used by terminal_tool) before scanning. Fails open on any ambiguity: executable and unquoted-delimiter heredocs stay scanned. Salvaged from PR #88336 by @zgqq (the heredoc half; its Branch D boundary and dir-token halves already landed/were fixed).