fix(cli/mcp): prevent command injection via $EDITOR/$VISUAL

[YoungDan-hero]

Summary

mcpEditConfigLaunchCommand concatenated the raw $VISUAL/$EDITOR value
into a sh -lc "<editor> <path>" command string. Only the path was
shell-quoted, so an editor value like vim; rm -rf ~ (or any environment
pollution) would execute arbitrary shell commands.

Severity

Command-injection hardening for local environment-controlled editor values.
Exploitation requires the environment variable to be set to a malicious value;
this is not remote-input execution, but it is still a real local attack surface
for shared accounts, compromised tooling, or untrusted config sources. Removing
the shell interpretation layer makes the MCP config editor launch path safer.

Fix

Replace the sh -lc construction with editorLaunchCmd:

1. Expand $VAR references via os.ExpandEnv (no shell)
2. Parse the editor value into argv with shell-style quote/backslash handling
   for word splitting only (supports code --wait, emacsclient -a '', and
   quoted editor paths)
3. Expand leading ~ / ~/ via os.UserHomeDir (no shell)
4. exec.Command(args[0], append(args[1:], path)...) -- binary resolved by OS

Shell metacharacters become literal argv tokens and cannot be executed. This
matches the safe pattern already used by the terminal-editor fallback
(exec.Command(bin, path)) in the same function.

Shell operators, globbing, command substitution, and redirection are
intentionally not evaluated. The now-unused shellQuote helper is removed.

Behavior preservation

EDITOR value	Prior (sh -lc)	New (exec)
vim	works	works
code --wait	works	works
emacsclient -c -a ''	works	works, including the empty argument
$HOME/bin/x	shell expands	ExpandEnv expands
~/bin/x	shell expands	leading tilde expands
'/Applications/Visual Studio Code.app/Contents/Resources/app/bin/code' --wait	shell parses quoted path	argv parser preserves quoted path
vim; rm -rf ~	executes rm	safe literal argv, no shell execution

Tests

• TestMCPEditConfigLaunchUsesVisualBeforeEditor -- direct invocation
• TestMCPEditConfigLaunchEditorWithArgs -- code --wait arg splitting
• TestMCPEditConfigLaunchEditorParsesShellStyleQuotes -- shell-style quotes,
  empty quoted args, escaped whitespace, and literal backslashes
• TestMCPEditConfigLaunchEditorRejectsUnterminatedQuote -- invalid quoted
  editor values fail cleanly
• TestMCPEditConfigLaunchEditorRejectsShellMetachars -- injection defense
• TestMCPEditConfigLaunchEditorExpandsEnvVar -- $VAR expansion
• TestMCPEditConfigLaunchEditorExpandsTilde -- ~ / ~/ expansion
• TestMCPEditConfigLaunchEditorTildeNotInPayload -- tilde not abused
• TestMCPEditConfigLaunchFallsBackToTerminalEditor -- fallback unchanged

Verification

• go test ./internal/cli -run 'TestMCPEditConfigLaunch' -- pass
• go test ./internal/cli -- pass
• git diff --check -- pass

Cache-impact

None. This only changes local CLI process construction for the MCP config editor
launch path.

Authorship note

@YoungDan-hero is the primary author of this PR. @SivanCola contributed a
maintainer follow-up that preserves shell-style quoted editor values while
keeping the no-shell launch path.