fix(agents): five more forms the push gate judges wrongly #809

Problem

Review of the push-gate change for #797 found five more forms that .claude/hooks/agent-bash-gate.sh judges wrongly. Each is uncommon, so they were left out of that change rather than holding it for another round. The gate's stated goal is guarding against accidents, not deliberate workarounds. Measured means run through the gate under bash 5.3 and macOS /bin/bash 3.2 by the reviewer.

Forms

1. $[ … ], bash's old arithmetic syntax, hides the lines after it. x=$[1<<3] followed on the next line by a guarded gh pr command is allowed (measured): the tokenizer reads the << as a heredoc and treats every later line as its body, while bash runs those lines. The same class of bug as fix(agents): three gh forms the reworked push gate still does not judge #797's $(( … )) item, for the $[ spelling.
2. A here-string that reads a shell variable is not treated like -f query="$q". q='mutation{markPullRequestReadyForReview…}'; gh api graphql -F query=@- <<< "$q" is allowed (measured), while the -f query="$q" form is blocked: the rule for a query computed from a variable is not applied on the new stdin path.
3. Single quotes inside a double-quoted default. echo "${x:-'$(…)'}" with a guarded command inside the $(…) is allowed (measured), but inside double quotes bash runs that $(…). The default is re-tokenized as if unquoted, where '…' is literal text.
4. A GraphQL query with variables is matched against the whole command line. A mutation($id: ID!) { resolveReviewThread … } sent alongside another field whose heredoc text names a guarded mutation is refused (measured), because a query containing GraphQL $id is treated like one that reads a shell variable. A false positive on an unusual form.
5. addPullRequestReview matches addPullRequestReviewThreadReply as a substring. A GraphQL thread reply or COMMENT review sent with -F body=@- whose body contains the word APPROVE is refused (measured); main allowed it. REST replies, the documented way to reply to a review thread, are not affected. A false positive on an unusual form.

Related

#797, #790, #740