Fix server subprocess command boundary

[saagpatel]

What

Keep server-triggered audit process creation on a fixed OS command and move validated request values to a JSON stdin payload consumed by a dedicated worker. Explicitly escape the dynamic action-row index and remove the related CodeQL suppressions.

Why

The current remote security receipt reports one critical and eight high CodeQL alerts. This patch removes form-derived values from subprocess.Popen arguments and makes the HTMX fragment boundary explicit so remote CodeQL can evaluate the real data flow.

Review Of What Was Built

• RunSession now launches only python -m github_repo_auditor.serve.worker.
• Validated username and allowlisted flags cross the process boundary through stdin JSON.
• The worker invokes the Python CLI entry point inside the child process.
• Action-row URL and element-id interpolation uses escaped values.
• Regression tests pin both command and worker argument boundaries.

Cleanup Review

Removed two reflective-XSS CodeQL suppressions. Preserved the pre-existing untracked portfolio-truth lock and made no generated-output changes.

Verification Summary

• Focused affected suite: 72 passed, 2 skipped.
• Ruff on changed files: passed.
• git diff --check: passed.
• Full-suite collection remains unknown because the optional responses dependency is absent; no package installation was performed.

Shipped Summary

The feature branch contains commit fcf10ba and is ready for CI and CodeQL review. It is not merged or deployed.

Next Phase

Wait for remote CI and CodeQL, inspect any surviving findings, then collect a newer authoritative GitHub security receipt and regenerate the source-matched PortfolioTruth/DecisionBrief outputs.

Remaining Roadmap

AIGCCore remediation remains out of scope; partial security-provider coverage and owner-bound BridgeDB actions remain separate lanes.