feat: handle command substitution and parameter expansion in shell scanner

[bosiakov]

• Extend ScannerState.Advance to track $(...), ${...}, and backtick command substitutions, preventing operators and spaces inside them from being treated as live delimiters
• Use a stack-based approach with stored open/close chars for O(1) delimiter matching and arbitrary nesting depth