Under the hood
A telemetry event now fires when per-command deny paths are requested but the command isn't actually sandboxed.
If per-command deny paths are requested but the command isn't actually running sandboxed, a new per_command_deny_unsandboxed telemetry event fires noting the deny list was ignored.