Code review 2026-09-24: security and safety fixes #67

The first of three PRs fixing the 39 confirmed findings of the 2026-09-24 code review (docs/reviews/2026-09-24-code-review.md): #1 paste injection, #3 absolute system tool paths, #5 dropped paths quoted per shell, #7 cd quoting, #13 DWM helper stdin error, #14 install close pre-answer, #15 updater installs only main's offer, #16 relative argv paths, #17 %V on a drive root, #18 atomic tabs.json, #19 installer spawn error and temp cleanup.