Permit single-quoted arguments in SHELL_SAFE_COMMAND_PATTERN while keeping dangerous metacharacters blocked, and add security test cases for quoted --entrypoint and --hostname values.