Add config option to disable exec subcommand

Please add a config field to disable the  subcommand (globally or per project). Agents keep calling  and it's annoying; I'd like a way to turn it off so only prompt/session modes are allowed.