The Guard's Stdin Redirect Scan Runs Past a Reserved Word #2032

_redirects_stdin in host-setup/agent-safety/claude/gh-write-guard.py scopes its scan to the loop's own invocation by stopping at the first separator operator. It does not stop at a reserved word, so a redirect on the next command inside a compound command reads as the loop's input bound.

Allowed today, and the loop reads the caller's stdin with nothing bounding it:

if while read l; do sleep 30; done then echo x < f; fi

The < f belongs to echo, not to the loop. bash -n accepts the line and bash runs it. The same holds after do, }, fi, and done of an enclosing compound.

The scan should end where the loop's command ends, which is a reserved word in command position as well as a separator. #1637 is the sibling defect in the process-substitution check one line above it.

Found by a local strict review pass on feature/auto-2028 (#2028). The code predates that branch.