What does this PR do?

Documents a security rule for process-introspection builtins: they must not read or expose raw host process argv / full command lines. The rule calls out /proc/<pid>/cmdline, macOS KERN_PROCARGS*, Windows command-line APIs, and equivalent sources. Process-listing commands such as ps remain scoped to process name / executable metadata unless an explicit security-reviewed exception is documented.

Motivation

Process argv can contain tokens, passwords, API keys, or other secrets from unrelated host processes. The rule makes that privacy boundary explicit for future builtins and preserves the existing ps design.

Implementation audit

Reviewed the current process-introspection and process-adjacent code paths. Production code does not reference /proc/<pid>/cmdline, KERN_PROCARGS*, Windows command-line APIs, or equivalent raw argv sources. ps populates CMD from process comm/executable metadata only, and ss rejects -p/--processes.

Testing

• Ran make fmt.
• Ran go test ./builtins/ps ./builtins/tests/ps ./builtins/ss ./builtins/tests/ss ./builtins/tests/help ./builtins/tests/uname.

Checklist

• Tests added/updated
• Documentation updated (if applicable)