Harden worker command execution and structured failures

[vamgan]

Summary

• execute command.run tasks with spawn and parsed argv instead of a shell-backed exec path
• enforce command allowlists against the parsed executable name
• return HTTP 200 for structured application-level worker failures so adapters can parse ok:false responses
• add regression coverage for shell metacharacters, quoted args, and structured failure status

Closes #5
Closes #6

Tests

• npm run typecheck
• npm test -- --run
• npm run build