Function add_shell_job_with_approval 

pub fn add_shell_job_with_approval(
    config: &Config,
    agent_alias: &str,
    name: Option<String>,
    schedule: Schedule,
    command: &str,
    delivery: Option<DeliveryConfig>,
    approved: bool,
) -> Result<CronJob, Error>

Create a validated shell job, enforcing security policy before persistence.

agent_alias names the agent under whose risk profile the command will be validated and executed. All entrypoints that create shell cron jobs should route through this function to guarantee consistent policy enforcement.