Executing the output of a download

Holds the command-substitution spelling of remote code execution — bash -c "$(curl …)", eval "$(wget …)", and PowerShell's iex (irm …). This is the shape block-curl-pipe-to-shell cannot see, because there is no pipe. Deliberately NOT matched: eval of a local command, which is how direnv, ssh-agent and every shell init line work — a rule that held those would be gone by the first morning. It therefore MISSES an eval of a variable that was filled by a download two commands earlier. A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone. That holds only while every shell metacharacter stays inside the quotes, so git commit -m "x" && … is still caught; and the carrier must be the first word, so sudo grep … is not exempt. curl --data is NOT one of those carriers here, because this rule's own trigger names curl/wget; and a $( inside double quotes is never exempt anywhere, because the shell expands it.