[bash] Variable-name parsing consumes first byte of following multibyte UTF-8 character

[zheng]

# Bash bug report: variable-name parsing swallows first byte of multibyte UTF-8 
char

## Summary
In a UTF-8 locale, `$VAR` immediately followed by a multibyte (non-ASCII)
character causes bash to treat the first byte of that character as part of the
variable name. Result:
- with `set -u`: `VAR<0xef>: unbound variable` (script aborts)
- without `set -u`: `$VAR` silently expands to empty (data loss, no error)

## Minimal repro (repro-minimal.sh)
```sh
set -u
V=xyz
echo "值 $V，尾"
```
Expected: `值 xyz，尾`
Actual (GNU bash 5.3.15, aarch64-apple-darwin, UTF-8 locale):
```
repro-minimal.sh: line 4: V�: unbound variable
```
Byte-level: the reported name is `V` + `0xEF` (first byte of U+FF0C FULLWIDTH
COMMA, UTF-8 `EF BC 8C`). Confirmed via `xxd`.

## Scope
Any multibyte UTF-8 character directly after `$VAR` triggers this, regardless
of lead byte: tested U+FF0C (ef), U+FF08 (ef), U+FF09 (ef), U+4E2D (e4),
U+2192 (e2), U+FF1A (ef), U+FF5E (ef), U+00B7 (e2) — all fail; ASCII `#`
after `$VAR` works fine.

## Environment
- GNU bash 3.2.57(1)-release (arm64-apple-darwin25) — macOS /bin/bash
- GNU bash 5.3.15(1)-release (aarch64-apple-darwin25.4.0) — Homebrew build
- Both fail in `en_US.UTF-8`; both work with `LC_ALL=C`

## Notes
- Workaround: use `${VAR}` braces (works correctly).
- Observed in the wild: multiple projects hit this (signet PR#29, autoagent
  commit 96e8cc6, nebula commit 555c688) and patched by brace-protecting
  variables adjacent to CJK text.
- Related upstream thread: "multibyte_identifiers" patch (bug-bash 2026-07)
  is about *allowing* multibyte identifiers; this report is about the
  *existing* parsing defect for adjacent multibyte chars.


## System
- uname: uname_result(system='Darwin', node='mzdeMacBook-Air.local', 
release='25.5.0', version='Darwin Kernel Version 25.5.0: Tue Jun  9 22:28:17 
PDT 2026; root:xnu-12377.121.10~1/RELEASE_ARM64_T8142', machine='arm64')
- bash: 5.3.15(1)-release (aarch64-apple-darwin25.4.0) — Homebrew build; also 
reproduced on macOS system bash 3.2.57(1)-release
- locale: en_US.UTF-8 (LC_ALL unset); NOT reproduced with LC_ALL=C


## Repro script (repro-minimal.sh)
```sh
#!/usr/bin/env bash
# 最小复现：bash 变量名解析吞并多字节 UTF-8 首字节
# 环境：UTF-8 locale；复现于 GNU bash 3.2.57 (Apple build) 与 5.3.15
# 用法：bash repro-minimal.sh
set -u
V=xyz
echo "值 $V，尾"   # 期望: 值 xyz，尾  实际: V\xef: unbound variable (exit 1)

```

## Trigger matrix (repro-trigger-chars.sh)
All of the following suffixes after `$V` fail (variable value is silently lost
without `set -u`, or `V<lead-byte>: unbound variable` with `set -u`):
U+FF0C, U+FF08, U+FF09, U+4E2D, U+2192, U+FF1A, U+FF5E, U+00B7.
ASCII `#` after `$V` works correctly.

## Expected vs actual
```
$ bash repro-minimal.sh
Expected: 值 xyz，尾
Actual:   repro-minimal.sh: line 4: V�: unbound variable   (exit 1)
```