fix(security): harden run.js binary path validation; annotate install.js fs_write

[Copilot]

An automated security scan flagged execFileSync in run.js:18 as shell_exec and fs.createWriteStream in install.js:104 as a risky fs_write. Both are false positives, but the code can be made more explicitly safe.

Changes

• scripts/run.js

  • Replace bare path.join with path.resolve for an absolute, normalised binary path
  • Add a containment assertion using path.relative() (cross-platform; avoids slash-direction ambiguity on Windows): if the resolved path escapes bin/, the process exits before execution
  • Inline comment clarifying execFileSync ≠ shell_exec: no shell is invoked, args are passed as an array

• scripts/install.js

  • Inline comment on fs.createWriteStream documenting that destinationPath is always inside a mkdtempSync temp dir and assetName comes from a hardcoded platform whitelist — not user input

// Before
const binaryPath = path.join(__dirname, "..", "bin", `md2wechat${ext}`);

// After — explicit boundary; path.relative() is cross-platform safe
const binDir = path.resolve(path.join(__dirname, "..", "bin"));
const binaryPath = path.resolve(path.join(binDir, `md2wechat${ext}`));
const rel = path.relative(binDir, binaryPath);
if (rel.startsWith("..") || path.isAbsolute(rel)) {
  console.error("Internal error: binary path is outside the expected bin/ directory.");
  process.exit(1);
}