sakthai-security-hardening

At the Trust stage and before any release: run bandit, review dependencies, keep subprocess use shell-free and arg-listed, and keep run_command opt-in. Justify every nosec. Prefer the narrowest permission that works.