Implements #379 (the second split of #96). The per-call onToolCall gate landed
in #377; this adds the optional shell risk classifier that pairs with it.

What

• classifyBashCommand(command): { level, reason }, level safe | review | high.
  Pure, dependency-free; no code copied from temodar-agent.
• Exported behind a new @open-multi-agent/core/classifiers subpath so the
  pattern tables never load unless imported (answers Optional shell risk classifier for the onToolCall gate #379's packaging question:
  core subpath, not a separate package).

Classification

• safe: read-only inspection (ls, cat, pwd, grep/rg with a path,
  git status|log|diff|show).
• review: context bombs and unknowns, per the Proposal: Per-call risk gating for built-in shell/filesystem tools #96 discussion: ls -R,
  find / / find ~ without -maxdepth, grep -r / rg -r without a scoped
  path, tree, du, and any unrecognised command ("don't run blind").
• high: destructive/sensitive: rm, sudo, curl | bash, dd, mkfs,
  chmod 777/-R, git push --force, npm publish, writes to system paths.

Compound commands are segmented on &&/||/;/|/newlines plus one level of
substitution, and the highest risk wins, so a safe prefix cannot smuggle a
destructive suffix (ls && rm -rf / becomes high). Quoted spans are stripped
first, so echo "rm -rf /" stays safe. Shallow heuristic, not a security
boundary; the tables are meant to be extended or replaced.

Pairs with the onToolCall gate from #377:

import { classifyBashCommand } from '@open-multi-agent/core/classifiers'

new OpenMultiAgent({
  onToolCall: async (ctx) => {
    if (ctx.toolName !== 'bash') return { action: 'allow' }
    const risk = classifyBashCommand(String(ctx.input.command))
    if (risk.level === 'safe') return { action: 'allow' }
    if (risk.level === 'high') return { action: 'deny', reason: risk.reason }
    return (await ui.confirm(ctx, risk)) ? { action: 'allow' } : { action: 'deny', reason: risk.reason }
  },
})

Scope

Classifier only. Docs and a runnable example are tracked separately in #380. No
change to the gate, tool grant, or existing behavior.

Tests

Core npm run lint and npm test are green (1312 tests). Adds table-driven
classifier tests (per level, compound-command escalation, false-positive guards,
return shape) and a subpath import smoke test.

Closes #379