v4.0.9 - Fix composer binary path escaping

Bug Fixes

• tallcms:update now works when Composer is installed at a path with spaces. findComposerBinary() was returning bare paths from the known-paths probe and command -v fallback; the caller then interpolated the unescaped path into an exec() shell command. On macOS Herd, where Composer ships at /Users/<user>/Library/Application Support/Herd/bin/composer, the update aborted at the composer-install step with sh: /Users/<user>/Library/Application: No such file or directory. Every return path now flows through resolveComposerCommand(), which escapeshellarg()s both the binary path and (for .phar installs) the PHP_BINARY prefix.

Test Coverage

• TallCmsUpdateComposerEscapingTest — 3 unit tests covering bare-path, space-in-path, and .phar resolution.