shell-command-guard. A lightweight Rust command wrapper that screens local shell invocations against configurable policy rules before executing the real command. Best-effort guardrail for agent workflows, with wrapper install, ordered allow/deny/delegate rules, shell normalization, and minimal denial output.