fix: resolve CodeQL baseline alerts

[atk0309]

What changed

• replace shell command strings in check-doc-impact.mjs with execFileSync("git", args) and reject option-like refs before Git sees them
• strip line separators from request-derived backend and renderer diagnostic fields
• use a constant console format string for render-fetch failures
• make the theme and sidebar pre-paint bootstrap source fully static
• add targeted regression tests and the required security, renderer, testing, and guidance documentation

Why

The first CodeQL run introduced by PR #7 established a useful baseline and reported 17 open alerts on main: one indirect command-line alert, one high-severity tainted format-string alert, thirteen log-injection alerts, and two bootstrap code-construction alerts. This patch addresses each source in code. It does not dismiss alerts or weaken the security-extended query suite.

Impact

This is security and diagnostics hardening only. Product behavior, authentication decisions, tenant isolation, CV content, and rendered output are unchanged.

Validation

• node scripts/quality-gate.mjs --fail-on-gap — PASS on the exact 15-file patch
• backend: 328 passed, 13 intentional skips
• frontend: 342 passed across 14 files
• production frontend build — PASS
• staged git diff --check — PASS
• pre-push guidance, invariant, and doc-impact checks — PASS
• follow-up branch open CodeQL alerts — 0 (main remains 17 until merge)

Known risks or follow-ups

• After merge, the push-triggered CodeQL run must complete before main can be confirmed at zero open alerts.
• Three backend concurrency tests remain intentionally Postgres-only; GitHub CI supplies Postgres.
• Ten provider live-spike tests remain intentionally gated on real provider credentials.

[atk0309]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 00542a15e4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".