Let guard commands run in dry run

Currently guard commands are not run in a dry run, and subsequently no exec commands are mentioned during a dry run.
I understand the conservatism behind this, but I think it's better to let them run because:
1. To make dry-run meaningful for configuration commands
2. Definitely safer than forcing users to skip dry-run
3. Guard commands are supposed to make no change