fix(security): remove eval from conformance runner

The conformance/run_conformance.sh script previously built a parser
command as a string and invoked it via `eval "${PARSER}" "$f"`, which
is a command-injection vector: a caller could pass $1 containing shell
metacharacters and execute arbitrary commands as whoever runs the
script.

Fix: build PARSER_CMD as a Bash array. If the caller passes a parser
command as $1, split it on whitespace into the array; otherwise use the
default parser invocation as array literals directly. Invoke via
`"${PARSER_CMD[@]}" "$f"` — no eval, no shell re-parsing.

This is the same fix applied to my-lang/conformance/run_conformance.sh
and is being rolled out across all language repos in the
nextgen-languages monorepo that share the same original script pattern.

Resolves one Critical panic-attack CommandInjection finding.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

conformance/run_conformance.sh

@@ -13,7 +13,15 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="${SCRIPT_DIR}/.."
-PARSER="${1:-mix run -e 'Phronesis.CLI.parse(System.argv())' --}"
+# Build PARSER_CMD as an array so we never need `eval`. If the caller
+# passes a parser command as $1, split it on whitespace; otherwise use
+# the default command directly.
+if [[ -n "${1:-}" ]]; then
+    # shellcheck disable=SC2206 # deliberate word-splitting of caller's string
+    PARSER_CMD=(${1})
+else
+    PARSER_CMD=(mix run -e 'Phronesis.CLI.parse(System.argv())' --)
+fi
 
 PASS=0
 FAIL=0
@@ -25,7 +33,7 @@ cd "${PROJECT_DIR}"
 for f in "${SCRIPT_DIR}"/valid/*.phr; do
     TOTAL=$((TOTAL + 1))
     name="$(basename "$f")"
-    if eval "${PARSER}" "$f" >/dev/null 2>&1; then
+    if "${PARSER_CMD[@]}" "$f" >/dev/null 2>&1; then
         echo "  PASS  valid/${name}"
         PASS=$((PASS + 1))
     else
@@ -38,7 +46,7 @@ done
 for f in "${SCRIPT_DIR}"/invalid/*.phr; do
     TOTAL=$((TOTAL + 1))
     name="$(basename "$f")"
-    if eval "${PARSER}" "$f" >/dev/null 2>&1; then
+    if "${PARSER_CMD[@]}" "$f" >/dev/null 2>&1; then
         echo "  FAIL  invalid/${name}  (expected failure, got success)"
         FAIL=$((FAIL + 1))
     else