pub fn validate_exe(exe: &Path) -> Result<PathBuf, String>Expand description
M8: --exe must be something we would trust to execv in our own pid:
an existing regular file (canonicalised), executable, owned by our uid
(or root — package-installed binaries), not group/world-writable.
Returns the canonical path. Same-uid 0600 socket → not a privilege
boundary; this is a footgun guard, not a sandbox.