fix: resolve Sonar defects

[aksOps]

Summary

• execute git and gh through absolute paths and reject relative test overrides
• provide an explicit string comparator for outbox storage ordering
• add regression coverage for unsafe executable overrides

Root cause

The CI monitor relied on PATH resolution for child processes, allowing executable substitution through a writable PATH entry. The outbox also relied on the implicit Array.prototype.sort() comparator, which Sonar reports as unreliable for Unicode strings.

The separate browser-storage vulnerability was reviewed against the full data lifecycle and marked false positive in Sonar with an evidence comment: the bounded plain-text value is JSON-serialized, sent as JSON, and rendered only through React text nodes.

Impact

The monitor no longer executes relative/PATH-resolved GitHub or Git binaries. Outbox ordering is explicit without changing its intended string ordering contract. Sonar's main quality gate is already back to OK; this PR should close the remaining real vulnerability and bug after analysis.

Validation

• npm test — 64 files, 902 tests passed; coverage floors passed
• npm run build
• node scripts/ci/test_ci_monitor.cjs
• node scripts/ci_monitor.cjs check-actions
• git diff --check

Sonar CLI verify --file was attempted, but this organization does not have Agentic Analysis enabled (HTTP 403). The normal PR analysis remains the authoritative Sonar validation.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud