fix: resolve DEP0190 warning with proper shell argument handling

Use string concatenation (not args array) when shell is needed to avoid
Node.js DEP0190 deprecation warning. Restores previous working approach
with conditional shell usage based on file extension.

Key changes:
- Added escapeShellArg() helper for proper argument escaping
- Conditional shell: only for .cmd/.bat/.ps1 files on Windows
- When shell needed: concatenate args into single escaped string
- When no shell: use array form (faster, no overhead)

Benefits:
- No deprecation warning
- Proper security (escaped arguments)
- Better performance (no shell on Unix or for .exe files)
- Matches previous stable implementation

Version: 2.4.9

lib/ccs

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 # Version (updated by scripts/bump-version.sh)
-CCS_VERSION="2.4.8"
+CCS_VERSION="2.4.9"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 readonly CONFIG_FILE="${CCS_CONFIG:-$HOME/.ccs/config.json}"
 

lib/ccs.ps1

@@ -134,7 +134,7 @@ function Show-Help {
 }
 
 # Version (updated by scripts/bump-version.sh)
-$CcsVersion = "2.4.8"
+$CcsVersion = "2.4.9"
 $ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $ConfigFile = if ($env:CCS_CONFIG) { $env:CCS_CONFIG } else { "$env:USERPROFILE\.ccs\config.json" }