[Fix] Execute package installs without a shell

[jsk1004ha]

Type of Change

• Bug fix
• New tool addition
• Improvement / refactor
• Documentation update

Summary

System package installation previously joined package names into a command string and executed it with shell=True. That made package arguments pass through a shell parser and made the execution path harder to validate safely.

This change:

• stores each supported package-manager invocation as an argv prefix;
• passes every package as a literal subprocess.run([...]) argument with no shell;
• rejects empty, whitespace-containing, NUL-containing, and option-like package names before execution;
• preserves Linux privilege escalation and keeps Homebrew unprivileged on macOS;
• reports an execution failure instead of raising when the package manager is unavailable;
• keeps PACKAGE_INSTALL_CMDS available for display and backward compatibility.

Validation

• PYTHONPATH=src python -m pytest -q tests/test_os_detect.py — 11 passed
• python -m compileall -q src/hackingtool/os_detect.py tests/test_os_detect.py — passed

The tests cover argv construction, privilege escalation, Homebrew behavior, shell metacharacters remaining literal, invalid option-like/package inputs, unknown managers, execution errors, and an empty-package no-op.

Checklist

• Title follows the required [Fix] ... format
• No new dependencies added
• Focused regression tests added and run
• Maintainers may modify the branch

AI assistance: the implementation and regression-test design were prepared with AI-assisted tooling; the focused checks above were rerun against the submitted source.