BUG: Command injection via EDITOR environment variable

[andrinoff]

Describe the bug
Editor execution uses EDITOR env var without sanitization. Shell metacharacters in EDITOR could enable command injection.

To reproduce

1. Set EDITOR="vi; malicious_command"
2. Run matcha config command
3. Shell injection possible

Expected behavior
Validate EDITOR path, use exec.Command with proper argument separation

Matcha version
master

OS
Unix-like

Additional context
File: cli/config.go
Security: command injection risk