fix(interpreter): fire EXIT trap inside command substitution subshell

[chaliy]

Summary

• EXIT traps set inside $(...) now fire and their output is captured by the substitution, matching real bash behavior
• Trap state is snapshot/restored so traps set inside $(...) don't leak to the parent shell
• Previously, EXIT trap output escaped to the parent's stdout instead of being captured

Test plan

• subst_exit_trap_captured — basic EXIT trap output captured inside $()
• subst_exit_trap_with_explicit_exit — EXIT trap fires on explicit exit 0 inside $()
• subst_exit_trap_no_leak — trap output stays inside $(), doesn't leak to parent
• subst_exit_trap_isolation — parent EXIT trap preserved when $() sets its own
• Full test suite green (cargo test --all-features)
• Smoke tested via CLI

Closes #806