0.1.4-alpha lands the issue netclaw-dev#27 fix: the parser extends the verb chain
greedily through every "verb-like" token until it hits a flag (-x) or a
path (anything containing / or .). Production hit on `git worktree list`
(extracted as `git worktree`, mismatching at retry time) is fixed —
multi-token CLI subcommands now extract cleanly without per-CLI tables.

Side effects:
- Auto-proposed verb patterns are narrower. `git push origin main` now
  proposes `git push origin main *` instead of `git push *`. This is
  intentionally tighter — approving the specific argument set is safer
  than approving the whole verb family.
- Test expectations updated for the new shape. Three new integration
  cases cover stop-at-flag, stop-at-path, and the multi-token CLI
  subcommand regression directly.
- TrustState xmldoc updated: verb-pattern matching is exact verb-chain
  equality + arg-glob suffix, so a stale `git push *` no longer matches
  a `git push origin main` invocation. Operators with persisted
  `git push *` from older runs will be re-prompted on the new shape.

557 Security tests + 314 Configuration tests + 1528 Actors tests pass.

The v2 approval matcher's `ExtractVerbChain` was capping at depth 2,
truncating multi-token CLI subcommands like `freshdesk ticket list` and
`git worktree list` to two tokens (`freshdesk ticket`, `git worktree`).
The truncation surfaced two ways in production:

- Approval prompts displayed misleading verb names ("Approve `freshdesk
  ticket` in this session?" for what is really `freshdesk ticket list`).
- Verb-chain mismatch between approval-prompt time and retry time
  threw `ToolApprovalRequiredException` mid-flight, surfacing as
  "I encountered an error executing a tool" with a correlation ID.

The 0.1.4-alpha ShellSyntaxTree bump shipped a greedy verb-chain
extractor (issue netclaw-dev#27), but it was only wired into the new
GateEvaluator/TrustStateComposer code path — which isn't on the live
runtime approval flow yet (trust-zones milestones B-N pending). This
puts it on the v2 path so the live prompt benefits immediately.

`ShellApprovalSemanticsBase.ExtractVerbChain` now delegates to
`BashParser.Parse(...).Clauses[0].Verb.Joined` for greedy extraction.
The path-aware/side-effect short-circuit (cap at depth 1 for cat, grep,
find, ls, echo, printf, etc.) is preserved as a post-check so positional
search patterns and target paths don't bake into persisted approval
keys (`grep secret /var/log/syslog` still extracts as `grep` alone).

`maxDepth` is now an upper bound rather than a default cap; the
default is `int.MaxValue` so callers get greedy extraction unless
they explicitly request a tighter chain.

Tests:
- ShellTokenizerTests: existing depth-2 expectations updated to greedy
  shape (`git push origin main`, `kubectl delete pod my-pod`,
  `docker compose up`). Path-aware verbs unchanged (cat, grep, ls
  still cap at 1).
- New regression theory `ExtractVerbChain_extracts_multi_token_cli_subcommands`
  pins the production hits: freshdesk ticket list, git worktree list,
  gh pr view, kubectl get pods.
- ToolApprovalGateTests: gate test renamed and re-asserted to expect
  the greedy chain on `git push origin main`.

561 Security + 1530 Actors + 314 Configuration tests pass.