Safe by default
Matches on key, not code — only a-z and 0-9 are allowed as non-modifier keys. Shift+digit is
rejected to avoid locale-dependent behavior. The mod2 keyword provides a safe cross-platform
secondary modifier (Ctrl on macOS, Alt on Windows/Linux).