SC2 crosses command and Markdown boundaries when matching curl pipelines #717

A health-check curl in a closed Markdown code fence is reported as downloaded-code execution because SC2 matches into a later table cell beginning with Python.

Reproduced on main 35270064e42230dbc566e4134c55b5d581355db3 and PR #700 head 6b75caf05359e60b9044c8816204b061eb858897.

Minimal input:

```bash
curl http://localhost:8000/cuopt/health
```

| Python API | REST |
| --- | --- |

Actual: SC2 HIGH, confidence 0.9, at line 2. The matched text crosses the closing code fence and reaches the table pipe and Python cell.

Expected: this HTTP GET has no executable pipeline and should not generate SC2 based on unrelated Markdown.

A public example is NVIDIA/cuopt's SKILL.md: the health check is at line 66 and the API table starts at line 97. Removing or renaming only the table's Python API row removes this finding. A separate later fenced pipeline can also be incorrectly attached to an earlier curl.

The fix should respect shell command and Markdown boundaries while retaining detection of genuine executable pipelines, including valid multiline continuations. Tests must retain positives for curl ... | sh and curl ... | python3.

Related: #638 and #700 address data consumers in real pipelines; this issue concerns matching across separate commands and Markdown regions.