fix(python): prevent heredoc delimiter injection in write()

[chaliy]

Summary

• Generate random heredoc delimiter suffix using secrets.token_hex(8) to prevent content injection
• Quote file path with shlex.quote() for path injection prevention
• Extract _build_write_cmd() helper for testability

Closes #412

Test plan

• Test verifies content with BASHKIT_EOF is written literally
• Test verifies file paths with spaces are properly quoted
• Test verifies each call generates unique delimiters
• ruff check and ruff format pass