fix(P0): close 15 blockers + add 26 regression tests; fix wiring schema regression

Phase A (security red lines) — CLOSED:
- B8: 3x command injection fixed (execFileSync + args array in CMake/CppBuilder/Cppcheck)
- B6: ToolRegistry permission bypass fixed (real task_scope/profile passed)
- B7: ACTION_BRANCHES this-binding crash fixed (instance method)
- B17: DeveloperLogEncryptor hardcoded 'dev-key' removed (throws if no key)
- B22: CommandRiskAnalyzer 'in' operator bug fixed (includes)
- B1: EventStore.project() transaction handle now passed to all repos
- B2: workspace projection illegal enum fixed (active/merged)
- B4: route_prefix separator unified to '/'
- B5: TaskAttempt column mapping fixed

Other blockers fixed:
- B3: project-level DB schema aligned to db-schema §20 (.air/local, learned_memories)
- B9: cpp.* tools registered through PermissionEngine path
- B11: Scheduler BLOCKED/CANCELLED states added
- B18: CapabilityTrustLevel 5-level enum aligned
- B19: PermissionEngine block/refuse/announce_then_run + grant_scope
- B20: Worker exit code 4 = parent_cancelled
- B24: project_id now randomUUID

Regression fix (introduced by B3 schema refactor):
- wiring.ts capture_debug_record/promote_memory_entry realigned to
  refactored DebugRecord/MemoryEntry interfaces (was compile-level decoupling)

Tests: 128 regression/unit tests pass (22 regression + 3 unit + 3 e2e suites)

Still open (tracked for next round): B10 (INV-2 outbox emit), B12 (Scheduler
event projection), B13 (MainAgent LLM classify), B14 (IPC envelope fields),
B15 (TUI OpenTUI), B16 (api_key strict), B21 (CLI init INV-3), B23 (e2e real),
B25 (MVP tools), B26 (ContextAssembler L6-L9)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/toolchain-cpp/src/analysis/CppcheckRunner.ts

@@ -5,7 +5,7 @@
  * @module packages/toolchain-cpp/src/analysis/CppcheckRunner
  */
 
-import { execSync } from 'child_process'
+import { execFileSync } from 'child_process'
 import { DiagnosticParser, type ParsedDiagnostic } from './DiagnosticParser.js'
 
 export interface CppcheckOutput {
@@ -23,8 +23,6 @@ export class CppcheckRunner {
   }
 
   run(project_root: string, options?: { enable_all?: boolean; check_config?: boolean }): CppcheckOutput {
-    // TODO(P5): Pass args as array to execFileSync for command injection safety.
-    // Currently uses execSync with string interpolation — UNSAFE for untrusted input.
     const start = Date.now()
     const args: string[] = ['--enable=all', '--inconclusive', '--error-exitcode=0']
 
@@ -33,9 +31,9 @@ export class CppcheckRunner {
     }
 
     try {
-      const output = execSync(`cppcheck ${args.join(' ')} ${project_root}`, {
+      const output = execFileSync('cppcheck', [...args, project_root], {
         encoding: 'utf-8',
-        stdio: 'pipe'
+        stdio: 'pipe',
       })
 
       return {

packages/toolchain-cpp/src/build/CMakeConfigurator.ts

@@ -5,7 +5,7 @@
  * @module packages/toolchain-cpp/src/build/CMakeConfigurator
  */
 
-import { execSync } from 'child_process'
+import { execFileSync } from 'child_process'
 import { existsSync, mkdirSync } from 'fs'
 import { join } from 'path'
 
@@ -29,26 +29,25 @@ export class CMakeConfigurator {
     const build_dir = config.build_dir || join(config.project_root, 'build')
     const generator = config.generator || 'Ninja'
     const build_type = config.build_type || 'Debug'
-    const args: string[] = config.cmake_args || []
+    const extra_args: string[] = config.cmake_args || []
 
-    // Create build directory
     if (!existsSync(build_dir)) {
       mkdirSync(build_dir, { recursive: true })
     }
 
-    // TODO(P5): Use execFileSync with array args for command injection safety
     const cmake_args = [
-      `-G`, generator,
+      '-G', generator,
       `-DCMAKE_BUILD_TYPE=${build_type}`,
-      `-DCMAKE_EXPORT_COMPILE_COMMANDS=ON`,
-      ...args
-    ].join(' ')
+      '-DCMAKE_EXPORT_COMPILE_COMMANDS=ON',
+      ...extra_args,
+      config.project_root,
+    ]
 
     try {
-      execSync(`cmake ${cmake_args} ${config.project_root}`, {
+      execFileSync('cmake', cmake_args, {
         cwd: build_dir,
         encoding: 'utf-8',
-        stdio: 'pipe'
+        stdio: 'pipe',
       })
 
       const cc_path = join(build_dir, 'compile_commands.json')

packages/toolchain-cpp/src/build/CppBuilder.ts

@@ -5,7 +5,7 @@
  * @module packages/toolchain-cpp/src/build/CppBuilder
  */
 
-import { execSync } from 'child_process'
+import { execFileSync } from 'child_process'
 import { DiagnosticParser, type ParsedDiagnostic } from '../analysis/DiagnosticParser.js'
 
 export interface BuildOutput {
@@ -24,13 +24,13 @@ export class CppBuilder {
 
   build(build_dir: string, target?: string): BuildOutput {
     const start = Date.now()
-    const target_arg = target ? ` ${target}` : ''
+    const args = ['--build', '.', ...(target ? ['--target', target] : [])]
 
     try {
-      const output = execSync(`cmake --build .${target_arg}`, {
+      const output = execFileSync('cmake', args, {
         cwd: build_dir,
         encoding: 'utf-8',
-        stdio: 'pipe'
+        stdio: 'pipe',
       })
 
       return {