Bandit-Clean Pwnagotchi Plugins: How `subprocess` Goes From Risk to Routine

Hardening a Pwnagotchi plugin against Bandit B602/B603/B607: shutil.which() full paths, argv-list calls, input validation, and the nosec discipline.