fix: Bulk Installer winget binary-planting LPE + search argument injection

[laurentiu021]

Summary

Two fresh ultra-audit findings (security-deep) in BulkInstallerViewModel, both confirmed by 3 adversarial verifier lenses (isReal=true, high confidence):

• P1 (LPE): winget launched by bare name from a hand-built process with no pinned working directory.
• P3 (injection): the raw search box text interpolated into the winget argument string.

The defects

MarkInstalledAppsAsync (runs automatically on tab open) and the package search each built their own ProcessStartInfo { FileName = "winget", UseShellExecute = false } with no WorkingDirectory. With UseShellExecute=false, Win32 CreateProcess searches the calling process's own directory before resolving the real winget App Execution Alias — so an attacker-planted winget.exe beside SysManager's single portable .exe (often run from a user-writable folder like Downloads, sometimes elevated) would execute with the app's privileges. Separately, the search argument was $"search \"{query}\" …" built from the unvalidated search box — the one process-launch trust boundary in the app without input validation — so a query containing a double-quote could break out and inject extra winget arguments.

The fix

Both winget calls now route through BulkInstallerService (the IPowerShellRunner seam):

• The runner launches winget with WorkingDirectory pinned to System32, removing the CWD from the CreateProcess search order — matching every other winget call in the app and closing the binary-planting vector.
• The search query is sanitized (double-quotes + control characters stripped, then trimmed) before interpolation; an empty-after-sanitize query never launches a process.
• Also brings the two calls into Gate-ARCH conformance — external process launches route through the single runner seam instead of a bespoke ProcessStartInfo. The obsolete SearchWingetPackages VM method is removed.

Regression tests

• SanitizeQuery_StripsQuotesAndControlChars / SanitizeQuery_EmptyOrUnusable_ReturnsEmpty — the injection guard.
• SearchAsync_RoutesThroughRunner_WithSanitizedQuery — dangerous quotes are gone from the argument string that reaches winget; the call goes through the seam.
• SearchAsync_EmptyAfterSanitize_NeverRunsProcess — a quotes-only query launches nothing.
• ListInstalledAsync_RoutesThroughRunner — the list path goes through the seam (WorkingDirectory pinned).

Checks

• All 3 projects build 0 warnings / 0 errors
• Leak scan on diff: clean