Epic: shell execution hardening

[bug-ops]

Summary

Shell sandbox relies on heuristic substring matching, bypassable via shell metacharacters ($IFS, backtick expansion, base64 encoding). Path canonicalization fallback on nonexistent paths is also exploitable.

Child Issues

• Replace substring blocked command detection with AST parsing or OS sandbox #628 Replace substring blocked command detection with AST parsing or OS sandbox
• Use std::path::absolute() as canonicalize fallback #629 Use std::path::absolute() as canonicalize fallback