ShellAllowlist

Process-global allowlist for run_shell. The host sets a set of command-line prefixes (e.g. "pm ", "am ", "settings put global ") at startup; the tool refuses any command not starting with one of those prefixes.

Conservative by design: empty allowlist = run_shell is disabled. The LLM cannot extend the allowlist; only host code can.

Not safe for parallel test execution. Tests mutate the global via set(emptySet()) in @BeforeEach/@AfterEach. If JUnit5 parallel test execution is enabled in this module, concurrent tests would race on prefixes. The current build.gradle.kts doesn't enable parallel mode; if you ever do, fence these tests with @Execution(SAME_THREAD) or refactor the allowlist out of process-global state.