Development record

The guard tokenizer does not recognise bash ANSI-C quoting or locale quoting, so \$'--force' tokenises to \$--force and a Tier-1 blocker (git push --force, rm -rf, --no-verify) is silently allowed while bash hands the child byte-identical argv, contradicting the doc.go invariant that quoting affects tokenisation not argument semantics.