[Security] Harden CLI dev command against injection on Windows #227

Job	Run time
checks / pre-commit	31s
checks / readme-snippets	14s
checks / test (3.10, locked, windows-latest)	2m 23s
checks / test (3.11, lowest-direct, windows-latest)	2m 20s
checks / test (3.10, lowest-direct, windows-latest)	2m 57s
checks / test (3.10, lowest-direct, ubuntu-latest)	46s
checks / test (3.10, locked, ubuntu-latest)	44s
checks / test (3.12, locked, ubuntu-latest)	51s
checks / test (3.13, lowest-direct, ubuntu-latest)	45s
checks / test (3.13, locked, windows-latest)	2m 29s
checks / test (3.11, locked, windows-latest)	2m 29s
checks / test (3.13, lowest-direct, windows-latest)	2m 40s
checks / test (3.12, lowest-direct, windows-latest)	3m 55s
checks / test (3.11, lowest-direct, ubuntu-latest)	44s
checks / test (3.14, locked, ubuntu-latest)	2m 18s
checks / test (3.12, lowest-direct, ubuntu-latest)	53s
checks / test (3.13, locked, ubuntu-latest)	46s
checks / test (3.11, locked, ubuntu-latest)	49s
checks / test (3.14, locked, windows-latest)	3m 52s
checks / test (3.12, locked, windows-latest)	3m 41s
checks / test (3.14, lowest-direct, windows-latest)	2m 18s
checks / test (3.14, lowest-direct, ubuntu-latest)	1m 14s
all-green	5s
	39m 44s

Provide feedback