post: run findmnt, df, and umount with argv arrays instead of shell strings

[rcooney-sh]

Security patch for vulnagent problem prb_ef0452cf3a0d8e30 (Medium, remediation group stickydisk-shell-quoting): command injection in the post-step cleanup via the path input. Aikido finding 654097526, Linear SEC-747.

The main step already quotes the path (shellQuote), but src/post.ts reads it back from state and interpolated it into five exec shell strings inside double quotes, where $(...) and backticks still expand. The pentest used path: /$(id>&2).* and got id output in the post-step log from sudo umount "...".

The fix removes the shell from every command that takes the path. src/mount.ts runs findmnt, df, and umount through execFile with argv arrays, and post.ts calls those helpers:

run("findmnt", ["-n", "-o", "SOURCE", "--mountpoint", mountPoint])
run("df", ["-B1", "--output=used", "--", mountPoint])
run("sudo", ["umount", "--", mountPoint])

The two mount | grep pipelines are gone: the mounted check and the device lookup collapse into findMountedDevice, which asks findmnt --mountpoint and falls back to parsing the mount listing in-process with an exact target match. This is also stricter than before: mount | grep "/mnt/cache" treated /mnt/cache2 as a hit and would attempt an unmount of a path that was never mounted. If nothing is mounted at the path the post step logs and returns as it did. Commands whose arguments come from the system (sync, drop_caches, blockdev --flushbufs on the device findmnt reported) are unchanged.

No path validation or charset restriction was added: with argv execution the input is only ever a filename, and rejecting characters would break legitimate paths (spaces, unicode) for no security gain.

Tests: src/__tests__/mount.test.ts checks a hostile path (/$(id>&2).*;\touch /tmp/pwned`|"x'y) reaches findmnt, df, and umountas one argv element, checks themountlisting parser matches the target exactly, and on Linux runs the real binaries:dffails on the hostile path instead of expanding it, and succeeds onos.tmpdir()`.

Draft because dist/ is not rebuilt. The build needs the private @buf registry (BUF_TOKEN), which this environment does not have, so the Build workflow will fail until someone runs npm ci && npm run build on this branch and commits dist/index.js and dist/post/index.js. Only dist/post/index.js should change materially; dist/index.js is untouched by the source change.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled. (Staging)}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}