Argv List Is Not Sanitization

Code passes attacker-controlled values to a subprocess by constructing the call as an explicit argv list rather than as a shell string, reading the choice of list form over `shell=True` as the threat model's full defense. The shell does not run; the receiver binary's own option-versus-positional parser does. List elements that begin with `-` present to the receiver as options regardless of what the calling code intended. The fix is the receiver's documented end-of-options separator (typically `--`) inserted before any attacker-controlled positional slot, or a value-shape predicate that rejects option-shaped inputs. The list form forecloses shell injection. It does not foreclose argument injection.