Function rewrite_argv 

pub fn rewrite_argv<R, F>(
    program: &str,
    argv: &[String],
    resolver: &ApprovalGatedResolver<R, F>,
) -> Result<RewritePlan, ArgvRewriteError>
where
    R: SecretResolver,
    F: Fn(&str) -> ApproveOnUsePolicy + Send + Sync,

Plan a substitution for the given child invocation.

program is the path or basename the caller will spawn ("gh", "/usr/local/bin/git", …). argv is the argument vector that follows it. The wrapper inspects argv for @secret:<path> aliases, asks the resolver for each value, and decides per alias whether to redirect through stdin or substitute in argv.

On Err(ArgvRewriteError::Resolve) the partial work is discarded — the caller cannot end up with half-resolved argv.