fix(security): address CodeQL scanning alerts

[Jaganpro]

Summary

• Exclude the generated Agent Script SDK bundle from CodeQL analysis instead of hand-editing vendored output
• Replace shell-string process execution with argv-based execution in maintenance scripts
• Harden URL/header handling and remove file existence pre-check patterns flagged by CodeQL
• Add narrow CodeQL suppressions for intentional temp-file spillover/download flows with inline justification
• Add regression coverage for Salesforce org URL parsing and unsafe cached ETag handling

Validation

• npm run validate
• npm run eslint

Notes

Local CodeQL CLI is not installed, so this PR relies on the GitHub CodeQL workflow for final scanner verification.