fix: prevent NVM POSIX class pattern panic

[roeyazroel]

Summary

• pin mvdan.cc/sh/v3 to an immutable v3.13.1-based fork commit containing the mixed POSIX character-class parser fix
• add a regression for NVM's exact *[![:space:]]* alias pattern
• keep the dependency delta isolated to pattern/pattern.go and its tests

Root cause

NVM 0.40.6 uses *[![:space:]]* while reading aliases. mvdan/sh stopped the outer bracket expression at the inner POSIX-class ], producing the invalid Go regexp (?s)^.*[^[:space:]\].*$. The interpreter passes successful pattern translations to regexp.MustCompile, so nvm use --lts panicked the entire Hash process.

The fork fixes POSIX classes as elements within larger bracket expressions and hardens filename-mode scanning around nested classes, escapes, slash literalization, malformed constructs, and unclosed brackets.

Upstream fix: mvdan/sh#1374

The replace is temporary and should be removed once an official mvdan/sh release includes that PR.

Validation

• focused regression: go test ./internal/executor -run '^TestShellPattern_NegatedPOSIXClassCompiles$' -count=1
• relevant packages: go test ./internal/compat ./internal/executor ./internal/shell — 501 tests
• full suite: go test ./... — 1,887 tests across 24 packages
• rebuilt interactive Hash: nvm use --lts selected Node v24.19.0; subsequent node --version returned v24.19.0; no panic
• git diff --check