fix(bash): guard PowerShell env output paths

[YOMXXX]

Summary

• add common PowerShell output commands and output-path parameters to bash external-directory scanning
• scan shell/PowerShell redirection targets before execution so external writes prompt external_directory before bash
• add regression coverage for fake pwsh $env:* output paths and external redirection targets

Fixes #1229

Tests

• bun test test/tool/bash.test.ts --timeout 30000
• bun typecheck
• git diff --check