hardening: restrict unserialize and audit exec command paths

[somethingwithproof]

Findings (validated by xAI Grok security review)

1. unserialize() with user data (MEDIUM)

linux_wmi.php:300: @unserialize($info, ['allowed_classes' => false]) - mitigated by allowed_classes but still risks deserialization issues.

2. exec() command injection (HIGH)

linux_wmi.php:245: exec($command) where $command is dynamically built. Audit for complete input sanitization.

Recommended fixes

1. Replace unserialize with json_decode where possible
2. Validate/escape all exec() command components

[somethingwithproof]

Fix PR open: #9