fix(cli): CLI command injection via exec() in github.ts (CWE-78)

[kvenux]

Bug Report

Description: packages/opencode/src/cli/cmd/github.ts:330-337 uses exec() with string interpolation to open URLs in the browser. Since exec() spawns a shell, any shell metacharacters in the URL would be interpreted, enabling OS command injection.
CWE: CWE-78
Severity: Medium (currently hardcoded URL, but pattern is unsafe if URL becomes dynamic)
Reproduction: See POC test in PR

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• fix(desktop-electron): OS command injection in CLI command spawning (CWE-78) #17345: Same author, same CWE-78 OS command injection class — targets a different file (desktop-electron/src/main/cli.ts) but very similar in nature. Consider whether these should be tracked together or merged.

[github-actions]

To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.