fix(security): replace npx with npm exec to prevent unintended remote package execution

[frankieyan]

Overview

npx silently downloads and executes packages from the npm registry when they aren't installed locally, which is a supply chain security risk. This replaces all npx usage with npm exec, which only runs packages already present in node_modules.

Changes

• .husky/pre-commit: npx lint-staged → npm exec lint-staged
• src/index.integration.test.ts: npx tsx → npm exec tsx --
• README.md: all user-facing examples updated from npx to npm exec with -- separators where arguments are passed

Test plan

• Run npm test to verify integration tests still pass
• Trigger pre-commit hook to verify lint-staged runs correctly

🤖 Generated with Claude Code

[doistbot]

This PR updates the codebase and documentation to replace npx with npm exec in an effort to mitigate the security risk of unintended remote package downloads. This is a valuable step toward tightening supply chain security across our development workflows. However, because modern npm allows remote lookups by default for both commands, successfully enforcing local-only execution requires appending the --no flag and -- separator to all updated instances.

_{Share Feedback • Review Logs}

[doistbot]

This PR replaces instances of npx with npm exec across the repository to improve supply chain security by preventing unintended remote package execution. This is a great proactive step that strengthens the security posture of the project's tooling and documentation. However, the update to the integration tests will likely cause failures because tsx is not installed in the fixture's local package.json, which will cause npm exec to exit with a missing-package error rather than running the CLI.

_{Share Feedback • Review Logs}

[rmartins90]

✅