Block destructive shell commands before execution. Prevents rm -rf, git push --force, AWS deletions, and more.