Command-name normalization now checks a known-binary allowlist before stripping version suffixes

The helper that normalizes command/process names for detection, used in bash-safety and permission logic, used to unconditionally strip trailing version digits (e.g. python3 → python). It now only strips the suffix if the resulting stripped name is in a known-binary allowlist, otherwise it keeps the original name intact.