Introduce Guard::Sheller to remplace system/` calls.