fix(P3): eliminate all execSync usage — uniform execFileSync pattern

3 P3 residuals found in independent audit, all non-exploitable but
inconsistent with the project security pattern (execFileSync + args array):

1. WorkerManager.find_bun: 'which bun' + 'test -x ${path}' replaced with
   existsSync() + hardcoded candidates (no shell). BUN_INSTALL env var added
   as first candidate.

2. CppTestRunner: 'ctest --output-on-failure' (literal string, safe but
   inconsistent) → execFileSync('ctest', ['--output-on-failure'], ...).

3. e2e.ts: 4 execSync calls (find tools + run depcruise/tsc) replaced with
   execFileSync + args arrays. Removed unused findDepcruise(). Inlined
   the 7 package paths instead of relying on shell glob expansion.

Verification:
- grep 'execSync' across packages/cli + packages/runtime/src +
  packages/toolchain-cpp/src returns 0 matches
- 28 execFileSync usages (uniform pattern)
- 169/169 tests pass
- tsc --noEmit: 0 errors

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/toolchain-cpp/src/test/CppTestRunner.ts

@@ -5,7 +5,7 @@
  * @module packages/toolchain-cpp/src/test/CppTestRunner
  */
 
-import { execSync } from 'child_process'
+import { execFileSync } from 'child_process'
 import { DiagnosticParser } from '../analysis/DiagnosticParser.js'
 
 export interface CppTestOutput {
@@ -22,7 +22,7 @@ export class CppTestRunner {
     const start = Date.now()
 
     try {
-      const output = execSync('ctest --output-on-failure', {
+      const output = execFileSync('ctest', ['--output-on-failure'], {
         cwd: build_dir,
         encoding: 'utf-8',
         stdio: 'pipe'