fix(security): replace shell-injection execSync and validate user-supplied RegExp to fix semgrep/ci

[Copilot]

The semgrep/ci job was failing because Semgrep's p/ci ruleset detected two real security issues in the codebase.

CWE-78: Command Injection — scripts/check-semgrep.js

execSync with a template literal passes input through a shell, flagged by Semgrep's child-process-injection rule:

// before — shell-interpolated, CWE-78
const output = execSync(`"${semgrepPath}" --version`, { encoding: 'utf8' }).trim();

// after — no shell, args array
const output = execFileSync(semgrepPath, ['--version'], { encoding: 'utf8' }).trim();

Both execSync calls (including the semgrep --version fallback probe) are replaced with execFileSync.

CWE-730: ReDoS / Non-literal RegExp — src/index.ts

handleFilterResults passed unsanitized MCP arguments directly to new RegExp():

// before — unvalidated user input
const pathRegex = new RegExp(args.path_pattern);

// after — rejects invalid patterns with McpError
let pathRegex: RegExp;
try {
  pathRegex = new RegExp(args.path_pattern);
} catch {
  throw new McpError(ErrorCode.InvalidParams, 'path_pattern is not a valid regular expression');
}

Same fix applied to message_pattern.