fix(platform): run commands as argv, not as strings handed to a shell - #567

Every command in this package was assembled by concatenation and handed to `sudo -n bash -c`, and nothing was
quoted. ParsePURL applies no charset validation to a package name and decodes the version through
url.PathUnescape, so %3B arrives as a semicolon. A name carrying shell metacharacters executed as root.

runShellCommand(command string, sudo bool) becomes runCommand(argv []string, sudo bool). The vector reaches the
kernel as a vector, so no shell parses it, nothing needs quoting, and no argument can inject: a package name
containing a semicolon is a package name containing a semicolon.

All seventy call sites converted -- sixty-four mechanically, five by hand, one already argv-shaped. The five are
the ones that looked like they needed a shell and did not:

dpkg-query -W -f='${Version}' and rpm -q --queryformat '%{VERSION}' carried single quotes whose only job was
hiding the format from a shell. dpkg and rpm parse those themselves, so as argv elements they need no quoting
at all.

brew's installRaw built its command as a string so it could vary on the cask flag; it now appends to an argv
slice.

launchctl list | grep -q and port installed | grep -q were pipes whose right-hand side was a substring test.
They are strings.Contains over captured stdout, which is also more precise than grep -- it searches what we
mean rather than what a pattern matches.

The wrapper keeps everything that concerns the child rather than the shell: commandTimeout, the endless y\n
stdin that auto-confirms prompts a tool raises despite its non-interactive flags, DEBIAN_FRONTEND, and sudo -n
so elevation fails fast rather than prompting on a tty.

captureRefresh records argv instead of a command string, and the three refresh tests compare with slices.Equal.

Not done here, deliberately. pkg/platform imports only pkg/iox from this module and every command uses
context.Background(); routing it through pkg/process.Runner would add a dependency on pkg/result and pkg/status
and thread a runner through the manager constructors. That is a layering decision, charted by 6.2 and 6.3, not
a mechanical rewrite. And no script tier is added, because all seventy commands are argv-shaped -- building an
unused fallback here would be speculative.

Verified with make check, and with build-all and vet-all across linux, darwin and windows: forty-six of the
conversions are in linux-tagged files that darwin alone never compiles.

Fixes #561.