Function expand_command_for_execution 

pub fn expand_command_for_execution<S: BuildHasher>(
    command: &[String],
    specs: &[ToolSpec],
    env: &HashMap<String, String, S>,
) -> Vec<String>

Expand trusted env only in spec-declared literal $VAR segments.

Placeholder-derived arguments remain opaque to prevent secret expansion in caller-controlled values.