planlint: shell metacharacters are accepted inside bare words #119

The tokenizer in scripts/multi-review-planlint.sh lets ;|&<>() through inside a bare word, so 'x'|cat reads as an entry with old-line x|cat where bash would run a pipeline. Spec B3 says any construct outside the three word forms is unparsed.

Fix is one character class added to the bare-word refusal set, plus a fixture and a mutation entry.

Split out of #114 (follow-ups from the fix-witness + plan-lint review of #113).

🤖 Filed by an AI agent — Claude Fable 5.1 (claude-fable-5-1), run by the maintainer.