Potential fix for code scanning alert no. 2: Uncontrolled command line

[Rootless-Ghost]

Potential fix for https://github.com/Rootless-Ghost/AtomicLoop/security/code-scanning/2

To fix this without changing intended functionality, add strict validation of input_arguments values before variable substitution. The best place is core/engine.py in run_test, right after input_args = input_arguments or {} and before substitute_variables(...).

Approach:

• Enforce input_arguments is a dict.
• Allow only scalar types (str, int, float, bool) and reject complex objects.
• For string values, reject shell-dangerous metacharacters (;, &, |, backticks, $, <, >, newlines, etc.) using a regex allow/deny check.
• Return a structured error instead of executing when validation fails.

This preserves the existing execution model while preventing attacker-controlled shell syntax from reaching subprocess.run through command interpolation.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.