test(fluxcontract): the shared-read pin accepts any command name that starts with kubectl #4755

The shared-read pin in internal/fluxcontract/snapshot_shape_test.go does not end the command name at a separator. So $(kubectlx get hr -o"jsonpath=${HELMRELEASE_HISTORY_JSONPATH}") and $(_cozy_guard_kubectl_v2 get hr ...) both pass as the shared read, though neither runs kubectl or the bounded wrapper.

No suite has either form today, and an unknown command fails loudly with exit 127. The case that matters is a second or renamed wrapper: it would pass the pin without anyone checking what it does with the jsonpath.

Requiring a space or tab after the command name, with a refuse case for each form, would close it.