Function canonicalize 

pub fn canonicalize(command: &str) -> CanonResult

Parse command (a bash command string, as a model would pass to the bash/shell tool) into its canonical sub-commands — the D-3 security core every rule-engine decision in crate::permissions::rules is built on. See the module doc comment for the fail-closed contract.