fix(parser): preserve glob in process substitution bodies

[chaliy]

Summary

Fixes #1333. Glob metacharacters like * adjacent to a quoted variable (e.g. ./"$var"*.ext) now expand correctly inside process substitution <(…) and >(…).

Before this fix, patterns like < <(ls ./"$prefix"*.tmp.html) silently matched nothing, even though the same pattern worked at the top level, inside $(...), inside (…), and inside { …; } | ….

Why

The parser re-serialised tokens inside <(cmd) back into a string before handing the body to a child parser. For QuotedGlobWord tokens (a word like ./"$var"*.ext), re-serialization wrapped the entire token's content in double quotes:

./$var*.ext   →   "./$var*.ext"

…which promoted the otherwise-unquoted * into a literal character, so the inner parser's pathname-expansion check at expand_command_args correctly decided not to glob.

How

Replace the 180-line token-to-string reconstruction loop with a single call to the parser's existing source_slice() helper: walk tokens to find the matching closing ), then slice the body verbatim from the original source. The child parser now sees exactly what the user wrote, so quote boundaries and glob metacharacters are preserved byte-for-byte.

TM-DOS-021 (depth/fuel budget propagation to the child parser) is preserved.

Test plan

• Added process_subst_glob_adjacent_quoted_var and process_subst_glob_cat to crates/bashkit/tests/spec_cases/bash/procsub.test.sh — both previously failed and now pass
• cargo test -p bashkit --test spec_tests bash_spec_tests ✅
• cargo test -p bashkit --lib parser ✅ (141 passed)
• cargo test -p bashkit --lib interpreter ✅ (206 passed)
• Manual smoke: bashkit -c '... < <(ls ./"$p"*.tmp.html | sort)' enumerates the expected files
• cargo fmt --check ✅
• Net -130 lines (parser code simplification)