Function validate_shell_command 

pub fn validate_shell_command(
    config: &Config,
    agent_alias: &str,
    command: &str,
    approved: bool,
) -> Result<()>

Validate a shell command against an agent’s security policy (allowlist + risk gate). agent_alias names the agent under whose risk profile the command will run. Returns Ok(()) if the command passes all checks, or an error describing why it was blocked.