fix(cli): avoid shell execution in module installs

[rissrice2105-agent]

Summary

• run module install commands with execFileSync argument arrays instead of shell strings
• validate module directory names before writing under the modules directory
• reject tarballs with absolute paths or parent-directory traversal entries before extraction

Tests

• corepack pnpm --filter @profullstack/threatcrush build