Harden Windows exec allowlist

Editor assessment

This commit patches CVE-2026-28391. The one-line header `fix: harden Windows exec allowlist` names the platform and the component, so the subject is clear on first read, and the type is right for a security correction. It drops the scope even though sibling commits in this repository use `fix(exec)`, so the affected area is only implied by the subject text. `harden` again leaves the actual defect and the new behavior unspecified, and the absence of any body means the Windows-specific bypass that prompted the change is never described. Tidiness and correct grammar keep it serviceable, but it reads like a changelog line rather than a teaching example.