fix(security): prevent shell injection in CLI tools

[riaworks]

Summary

• Replace all execSync with execFileSync + array-based arguments in bin/push.js and bin/lib/installer.js
• Eliminates shell interpretation of user-controlled data (commit messages, file paths, tokens)
• Use http.extraheader for git clone authentication instead of embedding token in URL
• Add token format validation regex

Findings Addressed

Finding	Severity	File	Fix
M-02	Medium (CVSS 6.1)	bin/push.js	execSync → execFileSync with array args
M-04	Medium (CVSS 5.3)	bin/lib/installer.js	execSync → execFileSync with array args
L-04	Low (CVSS 3.7)	bin/lib/installer.js	Token removed from clone URL
L-09	Low (CVSS 2.0)	bin/lib/installer.js	Token format validation added
L-10	Low (CVSS 2.0)	bin/lib/installer.js	http.extraheader for auth

Test plan

• Verify mega-brain push --layer 1 still works (git add, commit, push flow)
• Verify mega-brain push --layer 2 with manifest paths (force-add, commit, push --force)
• Verify mega-brain push --layer 3 backup flow (add -A, force-add, reset secrets, commit, push --force)
• Verify mega-brain push --dry-run shows correct output
• Verify premium install (fetchPremiumContent) with valid GitHub token
• Verify invalid token format is rejected with clear error
• Verify commit messages with special characters (quotes, backticks, $) work correctly

🤖 Generated with Claude Code