fix(P3): eliminate all execSync usage — uniform execFileSync pattern

3 P3 residuals found in independent audit, all non-exploitable but
inconsistent with the project security pattern (execFileSync + args array):

1. WorkerManager.find_bun: 'which bun' + 'test -x ${path}' replaced with
   existsSync() + hardcoded candidates (no shell). BUN_INSTALL env var added
   as first candidate.

2. CppTestRunner: 'ctest --output-on-failure' (literal string, safe but
   inconsistent) → execFileSync('ctest', ['--output-on-failure'], ...).

3. e2e.ts: 4 execSync calls (find tools + run depcruise/tsc) replaced with
   execFileSync + args arrays. Removed unused findDepcruise(). Inlined
   the 7 package paths instead of relying on shell glob expansion.

Verification:
- grep 'execSync' across packages/cli + packages/runtime/src +
  packages/toolchain-cpp/src returns 0 matches
- 28 execFileSync usages (uniform pattern)
- 169/169 tests pass
- tsc --noEmit: 0 errors

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/runtime/src/workers/WorkerManager.ts

@@ -7,7 +7,8 @@
  * @module packages/runtime/src/workers/WorkerManager
  */
 
-import { spawn, execSync } from 'child_process'
+import { spawn } from 'child_process'
+import { existsSync } from 'fs'
 import type { ChildProcess } from 'child_process'
 import { WorkerProcess, type WorkerExitCode } from './WorkerProcess.js'
 import { WorkerProtocol, type WorkerMessage, type WorkerMessageType } from './WorkerProtocol.js'
@@ -226,18 +227,17 @@ export class WorkerManager {
   }
 
   private find_bun(): string {
-    try {
-      return execSync('which bun', { encoding: 'utf-8' }).trim()
-    } catch {
-      // Try common paths
-      const common = ['/home/airlongdian/.bun/bin/bun', '/usr/local/bin/bun', '/usr/bin/bun']
-      for (const path of common) {
-        try {
-          execSync(`test -x ${path}`)
-          return path
-        } catch { /* */ }
-      }
-      return 'bun'
+    // Try common paths first (no shell, no string interpolation)
+    const candidates = [
+      process.env.BUN_INSTALL ? `${process.env.BUN_INSTALL}/bin/bun` : null,
+      `${process.env.HOME || '/root'}/.bun/bin/bun`,
+      '/usr/local/bin/bun',
+      '/usr/bin/bun',
+    ].filter((p): p is string => Boolean(p))
+
+    for (const candidate of candidates) {
+      if (existsSync(candidate)) return candidate
     }
+    return 'bun'  // PATH fallback
   }
 }