Let guard exec run in dry-run

Currently guard exec is not run in a dry run, and subsequently no command exec is mentioned during a dry run.
I understand the conservatism behind this, but I think it's better to let them run.
My justifications:
1. To make dry-run meaningful for configuration commands
2. Definitely safer than forcing users to skip dry-run
3. Guard exec is supposed to make no change