Fix 50 followups

[queil]

No description provided.

[strix-security]

Strix Security Review

No security issues found.

Review summary

Reviewed all three changed files. The substantive change is in src/Weir/Proc.fs, which adds a runtime plan-guard refusal to Proc.exec (process replacement via execvp) so it cannot bypass the plan sandbox that Proc.spawn already enforces. I verified every other process-start path funnels through the guarded spawn helper, so this closes the only remaining bypass — a genuine hardening, not a new exposure. The remaining changes are test coverage (tests/Weir.Tests/Tests.fs) and a CI smoke-script assertion (ci/release-smoke.weir) that still validates no credential leakage while dropping the brittle ***-placeholder pin. No security vulnerabilities were introduced by this PR.

_{Updated for 4735b89.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}