Try these changes:

  list: '(' item(s) ')'             { $item[2] }
  item: list <commit>               { $item[1] }
      | word
  word: / (?: [^()\\] | \\ . )+ /x
[download]

To have the list nonterminal actually return the arrayref, you need the semantic action to return $item[2]. Otherwise it would return the right paren every time.

The updated "word" regex says to repeatedly try to match either a normal char, or a backslash-escaped char.