Consider a server-side allowlist for operation arguments

The cell accepts the arguments the application assembled and refuses almost nothing. `Transforming#operations_for` refuses `combine_options` and hands everything else to `ImageProcessing`; the tool operations take raw argv.

Worth considering whether the cell should name what it accepts rather than pass through what it is given.

This revisits the argument-injection item the pre-release review raised and set aside, whose premise was that the payload comes from the trusted side.

No proposal yet, and no urgency.

Start with Transforming#operations_for and trace how arguments reach ImageProcessing and the tool operations' raw argv. Read the pre-release review's argument-injection item for the prior premise and discussion. Done requires a decided server-side allowlist design, including what the cell accepts and how refused arguments are handled.

Written by the indexing model from the issue text.