Wire the cd guard into Container.exec, as Trail 7 review found

The Trail 7 runner found that guard_leading_cd was defined and tested but never called, so the cd fix from d22eb69 was not active. exec now applies it, and a new test checks the script exec actually sends.