command-guard

Enforce .agentpolicy rules before executing commands.