fix: address code review feedback for VSCode extension

Security fixes:
- Replace exec with spawn in analyzeCommand to prevent command injection
- Use argument array instead of string interpolation for process spawning

Bug fixes:
- Assign extensionContext in activate() for restart functionality
- Use cross-platform path (os.tmpdir()) for debug logs on Windows

Improvements:
- Implement actual validation logic in validateCommand
- Display diagnostic counts after validation
- Add basic test coverage with Mocha

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: 2 people