Tainted Argv[0] Through Wrapper Skill
Same run(cmd) wrapper idiom as the layer-2 fix targets, but the program name itself
(argv[0]) is read from an environment variable at the one real call site — this is
still arbitrary program execution, and must stay a CRITICAL vet failure.