Potential fix for code scanning alert no. 2: Uncontrolled command line

[Rootless-Ghost]

Potential fix for https://github.com/Rootless-Ghost/AtomicLoop/security/code-scanning/2

Best fix: stop interpolating raw user input into shell command text. Instead, escape/substitute values safely per target shell before building the final command.

In this codebase, the least disruptive fix is:

1. Add a shell-escaping helper in core/executor.py that quotes each substituted value according to executor type (bash/sh via shlex.quote, cmd via conservative double-quote escaping, powershell via single-quote escaping).
2. Add a new substitution function that applies this escaping during #{var} replacement.
3. Update core/engine.py to call the new safe substitution function (for both main and cleanup commands), passing test["executor_type"].
4. Keep existing validation as defense-in-depth.

This preserves existing functionality (still supports same templates and executors) while neutralizing command injection vectors from input_arguments.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.