Potential fix for https://github.com/Rootless-Ghost/AtomicLoop/security/code-scanning/13

General fix: ensure any user-influenced command-line argument is strictly validated and canonicalized immediately before process execution, and fail closed if it does not match a narrow allowed format.

Best fix here (without changing functionality): in core/remote_executor.py, add a final defensive validation step right before building cmd_list, using a dedicated helper that only accepts canonical IPv4/IPv6 literals or RFC1123-style hostnames, then use that sanitized value in cmd_list. This keeps current behavior (valid hosts still work) while making the trust boundary explicit at sink proximity.

Changes needed:

• File: core/remote_executor.py
• Add a small helper function (near _HOST_RE) that validates a host string and returns a safe canonical value (or raises/returns failure).
• Replace the direct target_host = normalized_host usage with safe_target_host = ... from that helper.
• Use safe_target_host in both Windows and non-Windows cmd_list definitions and logging.
• No new dependencies required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.