[yashrajp22]

Rule messages that display shell placeholders using Markdown code delimiters can receive a parser limitation because those delimiters are read as shell command substitution. This change refines an existing source-owned limitation using proven inline boundaries and independent checks of command consumers and their operands.

Messages already handled completely by the Markdown parser keep that result. Raw and decoded security finding checks remain active, and existing runtime or resource limitations remain explicit. Additional generated or split command coverage is a separate parser change.

This is stacked on #1035 and #1049, which must merge first.