Function eval_args 

pub fn eval_args(
    args: &[String],
    policy: &ArgPolicy,
    deny: &DenyFlags,
) -> Result<(), ExecError>

Validate an args slice against the profile’s policy. Per-element. Order: deny_flags first, then allow mode. Empty slice always passes.