Disable CLI comprehension evaluation

[fallintoplace]

What changed

• stop auto-detecting and evaluating comprehension syntax in PythonicParser.parse_value()
• make parse_comprehension() reject comprehension input instead of executing it
• remove the now-unused AST evaluator that could reach raw eval(...)
• replace the old comprehension success tests with rejection coverage and a regression that proves a comprehension payload stays inert

Why

CLI config values are user-controlled strings. The previous comprehension path parsed the AST and then executed list, dict, and set comprehensions through raw eval(...), which allowed arbitrary code execution from CLI input.

Impact

Comprehension syntax is no longer supported in CLI values. Suspicious comprehension-looking strings now remain inert unless the caller handles them explicitly, and direct calls to parse_comprehension() fail with a clear error.

Checks

• uv run -- pytest test/cli/test_cli_parser.py
• uv run --group lint -- ruff check nemo_run/cli/cli_parser.py test/cli/test_cli_parser.py

[svcnemo-autobot]

PR #555 — needs attention
Blocking security finding: Comprehension execution remains reachable through the ternary path. nemo_run/cli/cli_parser.py:272-273 routes values containing if/else to parse_ternary(), and :463-466 performs unrestricted eval(value) after checking only that the root is ast.IfExp. A comprehension wrapped as [payload for _ in [0]] if True else [] still executes. Reject ternaries or recursively validate/evaluate a strict AST allowlist, and add this wrapped-comprehension regression.
Validation gaps: The new test at test/cli/test_cli_parser.py:642-650 covers only a bare comprehension. DCO is also ACTION_REQUIRED; no test/lint result is visible.