Potential fix for code scanning alert no. 11: Shell command built from environment values

[NovasPlace]

Potential fix for https://github.com/NovasPlace/CSM/security/code-scanning/11

The best fix is to stop invoking cmd.exe /c with a constructed command string and instead execute npm directly with argument-array passing on all platforms. This avoids shell interpretation and removes the injection/misparsing class completely while preserving behavior.

In scripts/release-package-stage.mjs, update the execution block around lines 64–70:

• Remove Windows-specific shell command assembly (ComSpec, cmd /c, quoteWindowsArg usage).
• Call spawnSync with a fixed executable (npm) and packArgs directly.
• Keep existing cwd, env, timeout, and output handling unchanged.

Also remove the now-unused helper quoteWindowsArg to keep the file clean and avoid dead code.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.