pub fn is_known_shell(exe: &str) -> bool
Defense-in-depth: reject known shells unless allow_shell.
allow_shell