Encode discovered skill identifiers safely in generated shell commands

[LadyBluenotes]

Problem

Discovered skill directory names are interpolated into runnable list output and install mappings without shell argument quoting. YAML string escaping does not protect the shell command inside the mapping.

Evidence

A synthetic skill directory containing a shell separator produced a mapping whose command executed an additional harmless printf when evaluated with the package runner replaced by a local printf stub. Execution requires a person or agent to run the generated command; discovery itself did not execute it.

Sources: list command formatting, mapping generation, identifier parsing.

Verified against main at 206e987 (@tanstack/intent 0.3.8), Node v24.12.0 on macOS arm64. Tests used installed dependencies and synthetic local fixtures.

Acceptance criteria

• Dynamic identifiers are validated and encoded as shell arguments before being emitted in runnable commands.
• List output, install mappings, and runtime lookup hints use consistent safe behavior.
• Metacharacters, substitutions, quotes, whitespace, and control characters cannot become executable command syntax.
• Valid scoped package names and nested skill paths remain loadable.
• Tests execute generated commands with harmless local stubs and assert the exact arguments and absence of extra execution for supported shells.

Scope and priority

Priority: High. Type: bug.

Recommended before v0.4.0. Keep the fix limited to identifier boundaries and generated commands; no general shell parser or unrelated installer refactor.

Delivery group

Grouped with #232 as a discovery-safety fix: validate untrusted identifiers before emitting runnable commands and check package containment before reading skill metadata. Installer picker and permission-review work in #243 stays separate.