fix(shell): allow trusted Moon test output pipelines

[bobzhang]

What changed

• classify trusted shell pipelines stage by stage instead of rejecting every pipe
• allow a trusted Moon source-writing command to feed the read-only head output limiter
• recognize and document both moon test -u and moon test --update
• keep arbitrary consumers, shell execution, tee, and writer-after-pipe forms sandboxed
• add the exact regression case: moon test cfront/build -u 2>&1 | head -40

Why

sandbox-exec applies to the complete sh -c process. The previous classifier rejected every pipeline before considering its individual stages, so piping a trusted snapshot update through head demoted the whole command to the source-read-only sandbox. Moon then failed to promote snapshots with Operation not permitted.

The new classification composes stage effects: the Moon invocation carries trusted-write capability and head is a read-only consumer. A pipeline is still rejected if a stage is untrusted or if a writer appears after a pipe.

Impact

Agents can run bounded test commands such as:

moon test cfront/build -u 2>&1 | head -40

Snapshot promotion can write the expected .mbt source while unsafe pipeline shapes retain the existing sandbox behavior.

Validation

• moon check agent_tool/shell --target native
• moon test agent_tool/shell --target native — 132/132 passed
• exact sandbox regression filter — 3/3 passed
• moon info && moon fmt — no interface changes
• just check
• just build
• just test — 3432/3433 passed; one unrelated desktop session-read test hit its 1s timeout, and its isolated rerun passed 1/1