security(tools): harden shell sandbox against process substitution and here-string bypass#907

bug-ops merged 2 commits intomainbug-ops/zeph:mainfrom

feat/856-shell-sandboxbug-ops/zeph:feat/856-shell-sandboxCopy head branch name to clipboard