Potential fix for code scanning alert no. 10: Uncontrolled command line

[Rootless-Ghost]

Potential fix for https://github.com/Rootless-Ghost/AtomicLoop/security/code-scanning/10

General fix: avoid passing user-derived strings directly into command arguments, even after filtering. Instead, transform inputs via a strict allowlist mapping to canonical hard-coded literals, and only pass mapped values onward.

Best fix here (without changing behavior): in core/event_collector.py, add a canonical allowlist mapping for log source names and use it in both collect_events and _query_wel. This preserves existing functionality while ensuring safe_log_sources is built strictly from compile-time constants. Keep subprocess.run with argument list and existing timeout bounds.

Changes needed:

• File: core/event_collector.py
• Add a new constant map near DEFAULT_LOG_SOURCES, e.g. ALLOWED_LOG_SOURCES_MAP = {name: name for name in DEFAULT_LOG_SOURCES}.
• Replace list-comprehension filtering in:
  • collect_events (around lines 92–95),
  • _query_wel (around lines 121–125),
    with canonical mapping through ALLOWED_LOG_SOURCES_MAP.get(src).
• No new dependencies required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.