Potential fix for code scanning alert no. 2: Uncontrolled command line

[Rootless-Ghost]

Potential fix for https://github.com/Rootless-Ghost/AtomicLoop/security/code-scanning/2

Best fix: enforce an execution allowlist in core/executor.py so execute() only runs command strings that exactly match the known atomic commands/cleanup commands for the selected executor type. This preserves existing behavior (running embedded tests) while blocking any command that is not part of the predefined catalog.

Implementation details:

• File: core/executor.py
• Add a private helper _is_allowed_atomic_command(command, executor_type) that imports ATOMICS locally and checks exact match against command and cleanup_command from catalog tests for that executor.
• In execute(), after normalizing executor_type and before dry_run/execution, reject commands that are not allowlisted by returning ExecutionResult(..., error=...).
• Keep all existing logic otherwise unchanged.

No new third-party dependencies are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.