fix(parser): unify indirect subscript consumption - #2734

What changed

Indirect references and ordinary parameter expansions now agree on where an
array subscript ends, including escaped and quoted closing brackets. A resolved
indirect target must consume exactly one complete reference before an explicit
caller-supplied suffix is appended.

Indirect reparses also share request work/cancellation state, inherit enclosing
command-substitution depth, and propagate deferred child-parser errors.

Why

The separate indirect validator and parameter parser used different escape and
quote rules. Text admitted as one subscript could be reinterpreted as an operator
operand downstream. Sharing the scanner removes this grammar disagreement while
retaining the existing exact-reference and restricted-substitution policies.

Before / After

Two tiny ordinary parser fixtures failed before the fix: an escaped-bracket key
became an array access plus leftover literal text, and an explicitly supplied
default operator was attached at the wrong boundary. After the change the key
is one complete array reference and the explicit default remains attached to it.

Safe local validation is refreshed after merging current main 41ea8ab3 into
the existing branch without rewriting history:

• Six unit fixtures: escaped/quoted/nested reference consumption, exact boundary
  admission, shared work/cancellation, inherited depth, and two existing ordinary
  parser compatibility checks.
• Four finite integration fixtures: nested-index Bash parity, escaped/quoted
  associative keys, explicit default/slice Bash parity, and malformed ordinary
  trailing text with session recovery.
• Lean clippy with warnings denied, formatting, OKF, and documentation links.

No direct recursive/resource-exhaustion reproducer was executed or added. Normal
unchanged CI provides the repository's complete gate; no CI or test policy is
changed by this PR.

Risk

• Medium: shared parser boundary handling affects array parameter syntax.
• Valid nested references and explicit caller suffixes remain covered. Existing
  modern-Bash rejection of trailing indirect-target text is preserved.
• No dependency, cap, stack-size, release, Input-module, or publication changes.
• Security review: grammar admission, UTF-8 boundaries, request-budget ownership,
  cancellation, child depth, and error propagation. Canonical TM-DOS-135 and its
  public summary are updated with the implementation.

Checklist

• Tests added or updated
• Backward compatibility considered