feat(tools): opt-in shell tool without interpreter: allowlist per chain element, no expansions/redirections, workspace-only, timeout, output limit, scrubbed env

config.example.yaml

@@ -29,5 +29,10 @@ tools:
     max_bytes: 524288
     timeout_sec: 15
     allow_private: false        # true allows localhost/LAN targets (SSRF risk)
+  shell:                        # opt-in; runs WITHOUT a shell interpreter, only in the workspace
+    enabled: false
+    allowed_commands: []        # e.g. [ls, cat, wc, head, tail, grep, date]; sh/bash/env/xargs/python/... are refused
+    timeout_sec: 30
+    max_output_bytes: 65536
   files_enabled: true
   file_max_bytes: 1048576