fix: distinguish tilde assignments from regex comparisons

[tobert]

An assignment followed immediately by a home-relative path was tokenized as a regex comparison operator. Separate the assignment delimiter from the tilde path outside tests, while preserving the regex operator inside tests and respecting nested command-substitution scopes.

Home-relative assignments now parse:

p=~/x
local p=~/x
p={x:empty}; p[x]=~/x
foo --path=~/x

Regex comparisons retain their operator, including after logical operators:

[[ a == a && x=~/x ]]
[[ $(p=~/x; echo $p) =~ /x ]]

The lexer uses its existing test and substitution frames to distinguish these contexts. A closing bracket qualifies only after a statement-head assignment target, so a glob character class cannot become an assignment delimiter. Logical operators inside a test now retain that test frame. Split and joined tokens use the original source spans; text adjacent to interpolation still requires quoting. Runtime tilde expansion keeps its existing behavior.

Validation: 12 regression cases failed before the fix; all 27 targeted cases pass, including token spans, plain/local/bracket assignments, named arguments, nested substitutions, regex operators with and without spaces, interpolation refusal, and a glob bracket that must not be treated as an assignment target. Workspace tests, clippy across all targets with warnings denied, rustdoc with warnings denied, kernel tests without default features, and the WASI build passed. Help fragments and generated syntax are synchronized.

Reviewed through kaibo's default cast, GLM-5.2 with DeepSeek V4 Flash investigation. The review also covers the preceding literal-word layer's final numeric punctuation cases. This layer builds on #440 in the native stack rooted at #437; no version bump.