fix(interpreter): split command substitution output on IFS in list context (#374)

## Summary

- Fix word splitting for unquoted `$()` command substitution in list
contexts (e.g., `for x in $(cmd)`)
- Previously, the entire command substitution output was treated as a
single token; now it is split on IFS characters (space/tab/newline by
default)
- Add 3 spec tests covering for-loop with find, space-separated words,
and newline-separated output

## Details

The root cause was in `expand_word_to_fields()` in
`crates/bashkit/src/interpreter/mod.rs`. For words that weren't array
expansions, it called `expand_word()` which returns a single
concatenated string, then wrapped it in a single-element vec. There was
no IFS-based field splitting step for unquoted command substitutions.

The fix checks if the word is unquoted and contains a
`CommandSubstitution` part. If so, the expanded result is split on IFS
characters (defaulting to space/tab/newline), with consecutive
whitespace collapsed and empty results elided. This matches POSIX shell
semantics and real bash behavior.

## Test plan

- [x] Added 3 new spec tests in `command-subst.test.sh` (for-loop
splitting, space splitting, newline splitting)
- [x] All 1308 bash spec tests pass (1184 passed + 124 skipped, 0
failed)
- [x] 1084/1084 bash comparison tests match real bash (100%)
- [x] `cargo fmt --check` clean
- [x] `cargo clippy --all-targets --all-features -- -D warnings` clean
- [x] Unit tests and threat model tests pass

Closes #347

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: chaliy

crates/bashkit/src/interpreter/mod.rs

@@ -5288,9 +5288,45 @@ impl Interpreter {
             }
         }
 
-        // For other words, expand to a single field
+        // For other words, expand to a single field then apply IFS word splitting
+        // when the word is unquoted and contains a command substitution.
+        // Per POSIX, unquoted $() results undergo field splitting on IFS.
         let expanded = self.expand_word(word).await?;
-        Ok(vec![expanded])
+
+        let has_command_subst = !word.quoted
+            && word
+                .parts
+                .iter()
+                .any(|p| matches!(p, WordPart::CommandSubstitution(_)));
+
+        if has_command_subst {
+            // Split on IFS characters (default: space, tab, newline).
+            // Consecutive IFS-whitespace characters are collapsed (no empty fields).
+            let ifs = self
+                .variables
+                .get("IFS")
+                .cloned()
+                .unwrap_or_else(|| " \t\n".to_string());
+
+            if ifs.is_empty() {
+                // Empty IFS: no splitting
+                return Ok(vec![expanded]);
+            }
+
+            let fields: Vec<String> = expanded
+                .split(|c: char| ifs.contains(c))
+                .filter(|s| !s.is_empty())
+                .map(|s| s.to_string())
+                .collect();
+
+            if fields.is_empty() {
+                // All-whitespace expansion produces zero fields (elision)
+                return Ok(Vec::new());
+            }
+            Ok(fields)
+        } else {
+            Ok(vec![expanded])
+        }
     }
 
     /// Apply parameter expansion operator

crates/bashkit/tests/spec_cases/bash/command-subst.test.sh

@@ -152,3 +152,36 @@ echo "$(echo "hello\"world")"
 ### expect
 hello"world
 ### end
+
+### subst_word_split_for_loop
+# Command substitution output is word-split in for-loop list context
+count=0
+for f in $(printf '/src/one.txt\n/src/two.txt\n/src/three.txt\n'); do
+  count=$((count + 1))
+done
+echo "$count"
+### expect
+3
+### end
+
+### subst_word_split_echo_multiword
+# Command substitution producing space-separated words splits in for-loop
+result=""
+for w in $(echo "alpha beta gamma"); do
+  result="${result}[${w}]"
+done
+echo "$result"
+### expect
+[alpha][beta][gamma]
+### end
+
+### subst_word_split_newlines
+# Command substitution with newline-separated output splits on newlines
+result=""
+for line in $(printf 'x\ny\nz'); do
+  result="${result}(${line})"
+done
+echo "$result"
+### expect
+(x)(y)(z)
+### end