🛡️ Sentinel: [CRITICAL] Fix arbitrary command execution via profile configuration

[bitcoiner-dev]

🚨 Severity: CRITICAL
💡 Vulnerability: The application executes bitcoin-cli directly via the profile configuration path without verifying the executable name. This allows arbitrary command execution (ACE) if an attacker can manipulate the profile.bitcoin_cli configuration parameter (e.g., executing /bin/sh or malicious binaries on the system).
🎯 Impact: An attacker who compromises the local configuration file could execute arbitrary scripts with the application's privileges when a user attempts to run commands interacting with the bitcoin node.
🔧 Fix:

1. Centralized run_bitcoin_cli in src/utils.rs by removing the unused duplicated version in src/wallet_service.rs.
2. Implemented binary filename validation in src/utils.rs to strictly allowlist execution of bitcoin-cli and bitcoin-cli.exe binaries only, regardless of the absolute path specified.
   ✅ Verification: Verified that tests pass via cargo test, code is formatted via cargo fmt, and clippy lints run via cargo clippy. Verified the fix ensures safe execution for trusted binaries.

---

PR created automatically by Jules for task 14955262588832582089 started by @bitcoiner-dev

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.