fix: code scanning alert 10 in provider dependency install

[jbeckwith-oai]

Summary

• move provider dependency installation to execFileSync with explicit argv
• keep the existing cwd, timeout, and error swallowing behavior
• add a unit test that verifies npm is invoked without a shell string

Root Cause

The verify path built a shell command with the output directory embedded in it before running npm install.

Validation

• npm test -- src/agent/loop-install.test.ts
• npm run build