fix: resolve Preflight security findings from PR #2 review

[jsingh6]

Fixes all findings posted by Preflight on PR #2.

Changes

• log-review.js — validate repo and pr args against allowlist patterns before use; switch execSync string to execFileSync array to eliminate shell interpretation; wrap readFileSync/JSON.parse in try/catch with empty-array fallback
• preflight-agent.sh — validate $REPO and $PR against expected patterns before any gh calls
• preflight.sh — handle gh auth token failure with a clear error message instead of silent empty token

[github-actions]

Preflight Review

This PR hardens the input handling and error resilience across the Preflight review scripts. The core change replaces execSync with execFileSync in log-review.js, which prevents shell injection by passing arguments as an array rather than interpolating them into a shell command string. Input validation was added to both the Node script and the agent shell script to reject malformed repo names and PR numbers before they reach any external commands. The log-review.js script was also made more resilient by gracefully handling a missing or corrupted reviews.json file rather than crashing, and preflight.sh now properly surfaces a failure from gh auth token instead of silently continuing. Taken together, the changes close an injection risk that existed when user-supplied repo and PR arguments were passed through shell string interpolation, and improve operational robustness when the data file doesn't yet exist.

Findings: 0 high, 0 medium — see inline comments