fix: prevent shell injection by replacing exec() with execFile()

[electricjesus]

Summary

• Replace exec() (shell string interpolation) with execFile() (argv array) in src/commands/open.ts and src/play/tui/App.tsx
• This eliminates shell command injection when URLs or API-sourced values (e.g. testCaseKey from Zephyr API responses) contain shell metacharacters
• For clipboard operations in App.tsx, data is now written via stdin.end() instead of being interpolated into a printf shell command

Motivation

exec() spawns a shell and interprets metacharacters. If a Zephyr API response returned a crafted testCaseKey (e.g. $(malicious-command)), or if a jiraBaseUrl config value contained shell metacharacters, arbitrary commands could execute on the user's machine.

execFile() bypasses the shell entirely by passing arguments as an array, closing this injection surface.

Changes

File	Before	After
src/commands/open.ts	exec(\open "${url}"`)`	execFile("open", [url])
src/play/tui/App.tsx	exec(\printf '%s' "${testCaseKey}" | pbcopy`)`	execFile("pbcopy", []).stdin.end(testCaseKey)
src/play/tui/App.tsx	exec(\open "${url}"`)`	execFile("open", [url])

Test plan

• Verify zephyr open <key> still opens the browser on macOS/Linux/Windows
• Verify o and e keybindings in the play TUI still open browser correctly
• Verify o still copies the test case key to clipboard
• Build passes (bun run build produces bundle successfully)