pub fn extract_static_write_paths(command: &str) -> Vec<String>Expand description
Return statically visible filesystem destinations written by a shell command.
This is deliberately conservative: dynamic expansions are ignored instead of guessed, while output redirects and common file-producing commands expose their literal destinations. Callers use the result for narrow path-policy checks, never as a general shell sandbox.