Harden internal Git command execution to prevent shell injection

[pomek]

📝 Provide detailed reproduction steps (if any)

1. Execute an internal command with shell-like payload in arguments, for example:

   const diff = require('./lib/commands/diff.js').default;
   diff.execute({
     arguments: [ 'test; touch HACKED; #' ],
     toolOptions: { packages: '' },
     repository: { directory: '' }
   });

2. Observe whether payload fragments are interpreted by the shell.

✔️ Expected result

Internal mrgit commands treat user-provided arguments as literal Git arguments and do not execute shell fragments.

❌ Actual result

Historically, several internal commands built shell command strings and could execute injected shell fragments.

❓ Possible solution

Introduce a safe internal Git runner using argument vectors (spawn with shell: false) and migrate vulnerable commands (diff, push, checkout, close, commit, sync) to use it. Keep mrgit exec shell-powered by design and document it as trusted-input only.

Definition of done

• Internal Git execution path does not use shell interpolation for affected commands.
• Regression tests cover shell-like payloads for affected command arguments.
• pnpm lint passes.
• pnpm test passes.
• Changelog entry added.

References

• Historical context: Security Fix for RCE on "mrgit" - huntr.dev #123