Summary

Adds a platform-aware shell allowlist to resolveShell() so client-supplied shell values on POST /api/projects/:id/terminals are validated before being passed to pty.spawn().

Before: any non-empty string from the client was passed directly to the PTY spawn, allowing arbitrary process execution as the daemon user (CWE-78).

After:

• Posix: only /bin/bash, /bin/sh, /bin/zsh, /bin/fish, /bin/dash (and /usr/bin/ equivalents) are accepted
• Win32: only powershell.exe, pwsh.exe, cmd.exe (case-insensitive)
• Non-allowlisted values are silently dropped; falls through to env default
• Path traversal / command injection blocked by exact string matching

Changes

• apps/daemon/src/terminals.ts: add SHELL_ALLOWLIST_POSIX, SHELL_ALLOWLIST_WIN32, isAllowedShell() helper, enforce in resolveShell()
• apps/daemon/tests/terminals-shell-allowlist.test.ts: 7 test cases

Surface area

This change affects the daemon terminal subsystem specifically:

• Route: POST /api/projects/:id/terminals (the terminal create endpoint)
• Function: resolveShell() in apps/daemon/src/terminals.ts
• Impact: Any client that sends a shell field in the terminal create body
• Desktop/Web: Both surfaces use the same daemon route, so both are protected
• Non-affected: Terminal resize, write, kill, list, and SSE streaming are unchanged

Validation

• Ran pnpm --filter @open-design/daemon test -- terminals-shell-allowlist — all 7 test cases pass
• Manually verified:
  • Sending {"shell": "/bin/bash"} → terminal spawns with bash ✓
  • Sending {"shell": "/tmp/evil"} → terminal spawns with default shell (not evil) ✓
  • Sending {"shell": "/bin/bash; rm -rf /"} → terminal spawns with default shell (exact match blocks injection) ✓
  • Omitting shell field → resolves from SHELL env as before ✓
  • Win32: {"shell": "powershell.exe"} accepted, {"shell": "calc.exe"} dropped ✓

Closes #5479