Run a shell command with the Workspace as the working directory.
Before crossing into host process execution, execute/2 acquires a bounded
host-command lease from Pixir.Tools.CommandBoundary (ADR 0027). This keeps OS
process fanout separate from BEAM-local Subagent/Workflow fanout.
Runs via a Port so a hung command can be killed on timeout (closing the port
terminates the spawned process — no orphan), unlike a blocking System.cmd/3. The
timeout is an open knob: context.bash_timeout_ms or config :pixir, :bash_timeout_ms
(default 120s), capped by bash_timeout_max_ms (default 600s). Host-command
concurrency and queueing use host_commands config.
v0.1 safety confines the cwd and rejects shell tokens that visibly resolve outside
the workspace — parent-directory references, absolute paths, home/env-home paths, and
existing symlink-prefix escapes — before crossing the host boundary. This is a
conservative tripwire, not a full shell sandbox. The permission gate (ADR 0006) is
still the higher-level guard: under :ask, non-safe commands prompt; under
:read_only they are refused.