Fix DEP0190 deprecation: execFile with shell:true passes args unsafely

[that-github-user]

Summary

Node.js DEP0190 warning appears on every thinktank run:
`Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.`

Location

src/scoring/test-runner.ts — uses execFile with shell:true and passes args as an array. Node.js warns this is unsafe because the args aren't escaped when shell mode is used.

Fix

Either:

1. Use exec (string command) instead of execFile with shell:true
2. Remove shell:true and handle command resolution differently
3. Suppress the warning if we've already validated the command (we do via validateTestCommand)

[that-github-user]

Fixed in #147. Replaced all execFile+shell:true with exec(string). Zero shell:true in production code. DEP0190 warning eliminated. Pre-publish security fix.