pub fn validate_command(command: &str) -> Option<String>
Validates a shell command before execution. Returns Some(error_message) if the command should be rejected, None if it’s safe to run.