feat(parser): expose per-command groups in parsed.calls

[srnnkls]

Problem

The flat parsed.commands / parsed.targets lists can't say which target a
given command acts on. So cat README && rm .env drops a read verb (cat) and
a secret (.env) into the same flat lists — a rule keying off "a read verb
and a secret target" fires even though nothing reads the secret. The join is
inexpressible because the relationship was flattened away before the rule sees it.

Fix

Add parsed.calls: each invocation grouped with its own command,
subcommand, action, targets, and flags. A rule can now match a single
call that both runs a read verb and targets a secret:

tool_input: parsed: calls: list.MatchN(>0, {
	command: _readVerb
	targets: list.MatchN(>0, _secretFile)
	...
})

This is parse-time pre-joining, not a relational match. The engine still
matches by subsumption; list.MatchN(>0, {command, targets}) over calls is an
ordinary existential over one struct's fields, so it stays within what
subsumption can verify. The flat lists are unchanged and remain deny-safe.

Tests

• internal/parser/bash_calls_test.go — per-command grouping (compound lines,
  read-of-secret, subcommand + flags).
• internal/contract/calls_join_test.go — end-to-end subsumption proof mirroring
  the evaluator's When.Subsume(input, …): fed real parser output, the flat
  shape matches both cat .env and cat README && rm .env; the join matches
  only the genuine read.
• #Parsed schema gains calls? (open-typed per the R5 rule); the bidirectional
  drift test pins it in sync with parser.Parsed.

The author-facing doc for the field lives with the GUIDE in #23 (GUIDE.md isn't
on main yet); it'll land there rather than duplicate the file into this PR.