Harden CLI installer command arguments

[Daliys]

Summary

• Replace CLI installer shell command strings with executable plus quoted argument construction.
• Keep Windows .cmd/.bat shims working through an escaped cmd.exe invocation.
• Add editor tests for metacharacter preservation and batch shim escaping.

Validation

• PYTHONDONTWRITEBYTECODE=1 scripts/prepush-validate.sh --static-only
• git push pre-push validation passed; live smoke was skipped because the Unity server returned HTTP 401 Unauthorized.

Issue: #65