Function update_shell_job_with_approval 

pub fn update_shell_job_with_approval(
    config: &Config,
    agent_alias: &str,
    job_id: &str,
    patch: CronJobPatch,
    approved: bool,
) -> Result<CronJob, Error>

Update a job with security validation for shell-command patches. Validates a new shell command against the named agent’s risk profile before persisting. Agent jobs remap command onto prompt first.