Fix Bandit B602: remove shell=True from subprocess call in bootstrap.py

[Copilot]

The Bandit SAST scan was failing with a High severity / High confidence finding (B602 / CWE-78) due to subprocess.run(..., shell=True) in bootstrap.py.

Changes

• bootstrap.py: Replace shell=True string-based invocation with a list-based one using shlex.split(). run_cmd now accepts either a str (split via shlex.split) or a pre-built list, removing the shell injection surface.

# Before
subprocess.run(cmd, shell=True, check=True, capture_output=True, text=True)

# After
args = cmd if isinstance(cmd, list) else shlex.split(cmd)
subprocess.run(args, check=True, capture_output=True, text=True)

All existing callers pass formatted strings (e.g. f'"{pip_exe}" install -r {req_file}'); shlex.split handles the quoted executable path correctly across platforms.