fix(safari): avoid shell interpolation during upload

[WNZhao]

Summary

• invoke xcrun altool with execFileSync and a literal argv array
• pass the upload secret only in the child environment
• stop falling back to notarytool, which notarizes Developer ID artifacts but does not upload App Store builds
• add a regression with shell metacharacters in the artifact path and Apple ID

Bug

The Safari target interpolated artifact paths, Apple IDs, key IDs, issuers, and a private key into shell command strings. Values containing command substitution or quotes could execute unintended shell code, and the private key was embedded in a second command. If the real upload failed, the adapter then ran an unrelated notarization command and could falsely report that the App Store upload succeeded.

Validation

• failing-before regression captured the interpolated $(...) shell command
• pnpm exec vitest run packages/targets/browser-safari/src/index.test.ts --reporter=dot (6/6)
• pnpm --filter @profullstack/sh1pt-target-browser-safari typecheck
• git diff --check