fix(cli): shell-quote positional argv so shell metacharacters survive the internal re-parse

[anonx3247]

Summary

srt -- cmd arg1 arg2 ... silently mangles (or outright fails on) any argument containing shell metacharacters. The CLI builds the command string with commandArgs.join(' ') (src/cli.ts line 151 on main) and then hands the result to spawn(cmd, { shell: true }), so bash re-parses it. Every unquoted paren, quote, backtick, $, |, ;, or glob in an argv element gets reinterpreted as shell syntax.

This PR routes argv through shellquote.quote — the same library already used across src/sandbox/*-sandbox-utils.ts to produce shell-safe command strings — so each argv element round-trips through the bash re-parse as a single literal argument.

Reproduction (before the fix)

$ srt -- printf '%s' 'hello (world)'
bash: -c: line 1: syntax error near unexpected token `('
bash: -c: line 1: `printf %s hello (world)'

$ srt -- printf '%s' "it's a test"
# hangs — bash waits for the closing single quote

$ srt -- printf '%s' '$HOME is literal'
/Users/alice is literal
# $HOME expanded despite being a literal positional argument

After the fix, all three behave as argv-semantics callers expect: the positional argument arrives at the child process byte-for-byte.

Design notes

• The -c <command> flag is unchanged and still does no escaping, by design — that mode is the escape hatch for callers who want bash interpretation (pipes, substitution, expansion).
• Default argv mode now has argv semantics, matching every other CLI tool that forwards arguments (e.g. env, xargs -0, nice, nohup, etc.).
• shell-quote is already a dependencies entry in package.json — no new dep added.

Tests

Five regression tests added to test/cli.test.ts under the existing default mode (positional arguments) describe block, covering:

• parentheses in an argument
• single quotes
• backticks (must not trigger command substitution)
• literal $VAR (must not expand)
• a combined realistic prompt argument mixing all of the above

All new tests assert the argument round-trips through printf '%s' <arg> unchanged.

Test plan

• bun test test/cli.test.ts — all 20 tests pass (15 existing + 5 new)
• npm run typecheck — clean
• npm run lint:check — clean
• CI on this PR