e2e: harden CLI runner with argv-safe process execution

[codeaholicguy]

Current coverage

The E2E helper interpolates a single argument string into execSync, inheriting a shell and making adversarial quoting/path cases unsafe to parameterize.

What is missing

• An argv-array runner using spawnSync or execFileSync
• Separate stdin input support for agent send --stdin
• Explicit timeout/signal reporting
• Reliable stdout/stderr Buffer/string normalization
• Paths and arguments containing spaces, quotes, shell metacharacters, and Unicode
• Backward migration of existing tests without changing behavior

Risk ranking

Foundational medium: runner hardening is recommended addition 24 and enables safe coverage of higher-risk command inputs.

Recommended E2E tests

• Add an argv-array runner based on spawnSync(process.execPath, [CLI_PATH, ...args]) so quoting, whitespace, and hostile path cases can be tested without shell interpolation.

Acceptance criteria

• The checklist tests are merged under e2e/.
• All existing E2E callers migrate to argv arrays or a clearly deprecated compatibility wrapper.
• New helper tests cover stdin, timeout, spaces, quotes, metacharacters, Unicode, and non-zero exits.

Related audit findings

This is test-infrastructure hardening; it enables validation of security-sensitive inputs in A1, A2, A7, and channel/agent command paths.