The Guard's eval Prefix Walk Misses a Redirected Runner and a Spaced Subscript #2446

Problem

The guard's eval reading (#2080) walks back from an eval over the prefixes bash allows before it. Two prefixes it does not recognize leave the eval unread, although bash runs it.

• A redirection between command or builtin and its options. The walk reads options only as a run of dash words directly after the runner.
• An array subscript holding unquoted spaces. The tokenizer splits a[1 + 1]=x into several words, so no one word reads as an assignment. Bash reads it as one word, reports "not a valid identifier", and still runs the command after it. The bash -c path already denies the same prefix.

Reproduce (constructed)

Each of these is allowed, and bash runs the loop:

command 2>f -p eval 'until false; do sleep 1; done'
builtin 2>f -- eval 'until false; do sleep 1; done'
a[1 + 1]=x eval 'until false; do sleep 1; done'
a[ 0 ]=1 eval 'until false; do sleep 1; done'

Done looks like

Each command above is denied and pinned by a self-test row. Separately, _eval_payload moves a word that str.isdigit accepts into the redirection list without the ASCII check _runs_eval makes, and without knowing whether it touched the redirection. No verdict is known to change from that, but the two readers should agree on what an fd is.

Found by a local strict review pass on the #2080 branch. Develop allows each command too, since it reads no eval argument at all.