refactor: use shutil.which for secure command check

[RinZ27]

Replaced insecure os.system call with shutil.which in check_cmd_exists function.

Context

The original implementation constructed a shell command by concatenating the input command string:

check_command = "where " + command  # Windows
check_command = "command -v " + command + ... # Unix
os.system(check_command)

This pattern is vulnerable to command injection if command comes from an untrusted source. While check_cmd_exists is currently used internally, it is a public utility function exposed by the library, making it a potential security risk if misused by consumers of the library.

Fix

Refactored to use shutil.which(), which is the standard, secure, and cross-platform way to check for executables in Python. It avoids shell execution entirely.

Benefits

• Security: Eliminates Command Injection risk.
• Simplicity: Reduces 6 lines of complex platform-specific logic to 1 readable line.
• Performance: Avoids spawning a shell subprocess.