fix: avoid shell execution for npm installs

[gh-xj]

Summary

Closes #23.

• validate managed CLI version specifiers before using them in install paths or npm package specs
• run npm view and npm install via execFile argument arrays instead of shell command strings
• add focused tests for unsafe version rejection and argv-based npm invocation

Verification

• bun run vitest run tests/versions.test.ts
• bun x tsc --noEmit
• bun run build

Full bun run test still fails locally with unrelated existing failures in:

• tests/permissions.test.ts
• tests/sandbox.test.ts
• src/lib/__tests__/git-sync.test.ts

Notes

Opened as a draft because this touches a security-sensitive command execution path. I kept the public issue high-level and can adjust disclosure/details to maintainer preference.