Function is_standalone_tracevault_subcommand 

pub fn is_standalone_tracevault_subcommand(
    command: &str,
    subcommand: &str,
) -> bool

True iff command is a single, simple invocation of tracevault <subcommand> — no shell compounding of any kind. Rejecting compounds is the security crux: tracevault verify-start && rm -rf / must NOT match, or the gate could be tricked into ignoring a hidden command.