Read a Command String env -S Runs in the Write Guard #3090

Context

Found by the local review of the pull request closing #3006 and #3004, after it merged develop's #3082 and #3087. Develop's guard shares it. It was confirmed with classify probes on constructed commands against develop's guard.

A Command String env -S Runs Is Not Read

GNU env -S splits its string into a command and runs it. The guard passes env as a precommand and never reads that string as a command, so each of these is allowed:

• env -S 'gh pr merge 5 --admin'
• env -S 'git push --no-verify origin feature/x'
• env -S 'git commit -an -m x'

Possible Direction

Read an env -S or --split-string value as a command the way a wrapper shell's -c body is read, an attached -S'...' included.