allowlist approach for node level execution

[reef spindle]

On a Windows node host (v2026.4.20), since all exec goes through cmd.exe /d /s /c hardcoded — is the correct approach to allowlist only cmd.exe with argPattern constraints, rather than allowlisting the individual binaries like git.exe or docker.exe? Or should both be in the allowlist?