Avoid invoking local resume through sh -c

[stevehenderson]

Severity

Medium

Problem

Local resume runs generated state-derived commands through sh -c, adding an unnecessary shell interpretation boundary. Current quoting tests cover common POSIX metacharacters, but any future quoting regression can become local command execution.

Location

• probe/crumb.ts:148-166
• probe/crumb.ts:864-866

Proposed fix

Spawn opencode directly with cwd: directory and [-s, sessionId], and use a separate controlled path for tmux when requested. Add tests proving state-derived values remain arguments rather than shell code.