Make shell=False explicit in subprocess calls.
(It was already the default, but let's be sure.)