feat: add readonly mode with bash safety and spawn child filtering

feat: add readonly mode with bash safety and spawn child filtering #26