Potential fix for code scanning alert no. 2: Uncontrolled command line

[Rootless-Ghost]

Potential fix for https://github.com/Rootless-Ghost/AtomicLoop/security/code-scanning/2

To fix this without changing intended functionality, enforce strict sink-side validation in core/executor.py before _build_command(...) / subprocess.run(...):

1. Keep existing allowlist logic.
2. Add a command safety validator that rejects clearly dangerous metacharacters and control characters for interpreter-based executors.
3. Apply this validator in execute() after allowlist check and before building/running the command.

Best single approach here: add a private helper (e.g. _is_safe_command_text) in core/executor.py and gate execution with it. This preserves behavior for normal embedded atomic commands while preventing accidental execution of malformed/injected command strings and making trust boundaries explicit to CodeQL.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.