wip: potential fix for code scanning alert no. 4: Shell command built from environment values

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: vobu

tests/integration/plugin-lifecycle.test.ts

@@ -245,7 +245,7 @@ export const commands = {
       assert.ok(existsSync(builtPluginFile), 'Built plugin file should exist');
 
       // Step 4: Load the plugin
-      execSync(`node src/index.ts load plugin --from file:${scaffoldDir}`, {
+      execFileSync('node', ['src/index.ts', 'load', 'plugin', '--from', `file:${scaffoldDir}`], {
         cwd: process.cwd(),
         stdio: 'pipe',
         timeout: 10000