fix: remove unsafe exec() in g_spawn.c

[orbisai0security]

Summary

Fix critical severity security issue in game/g_spawn.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	game/g_spawn.c:92

Description: Five calls to sprintf() in the entity spawn function write formatted path strings into a fixed-size stack buffer without any bounds checking. The format strings incorporate attacker-influenced values: edict->variation (an integer from map data), edict->class_id (used via the DESTRUCTABLE_TEXTURE macro), and the path strings dir and file. If any of these values are supplied via a crafted map file or network packet, the resulting string can exceed the buffer size, overflowing the stack and overwriting the saved return address, enabling arbitrary code execution.

Changes

• game/g_spawn.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security