pub fn normalize_command(cmd: &str) -> Cow<'_, str>
Normalize a command by stripping common wrappers (sudo, time, env, etc.)