rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators

An attacker induces an LLM agent (e.g. through prompt injection or malicious repository content) to run a crafted shell command that begins with an allowed prefix such as `git` but appends a hidden command via newline (`\n`), background operator (`&`), command substitution (`$(...)`), or backtick substitution. The permission splitter in rtk rewrite only inspected the outer prefix, returned exit code 0 (auto-allow), and the hook emitted `permissionDecision: "allow"`. Bash then executed the full command including the hidden payload, bypassing the user's configured deny or ask rules. [CWE-863] [CWE-88] [ref_id=1]

The advisory does not include a patch diff, but the test results on the patch branch (`security/fix-permission-splitter-bypass`, commit `39859913c523`) show the fix makes the permission splitter treat newline, background `&`, command substitution, and backtick substitution as command boundaries. The hidden commands now either return exit=2 (deny) or exit=3 (not auto-allowed) instead of exit=0 (auto-allow). The advisory recommends splitting on those constructs outside quotes, never auto-allowing commands that contain non-attestable shell constructs, and preserving correct behavior for redirect operators such as `2>&1`. [ref_id=1]