[fix] nopy: spawn the pyinfra argv, never a shell string

Closes DOCS-AUDIT §4.2 (point 3, the last one open) and §1.3.

`executeCall` joined `DeployCall.command` and ran it through
`execa({shell: true})`, which made every value on that command line shell
syntax. The finding framed it as a quoting problem "in the password"; it was
wider than that. `--data` values were interpolated inside double quotes, so a
backtick or a `$(…)` in *any* variable value was command substitution and a `;`
ended the command and began another.

`buildDeployCall` now emits a true argv — one element per argument, nothing
pre-quoted — and the executor spawns `execa(command[0], command.slice(1))` with
no `shell` option at all. pyinfra is still found on PATH and stdio stays
inherited, so live output is unchanged.

`maskCommand()` walks the argv by position instead of pattern-matching a joined
string, which closes a leak of its own: it used to bound a secret's value on the
closing `"` the builder had written two modules away, so a value containing a
`"` leaked its own tail. It is now the only thing that turns the command back
into a string, for display, and it shell-quotes as it goes so `--print-only`
output stays pasteable.

Also in `buildDeployCall`: `logConfigToFlags()` finally has a caller (§1.3). It
was exported and unit-tested with nothing consuming it, so `log.verbosity` and
`log.debug` in `.nopyrc.json` did nothing at all. The flags are prefixed onto
the argv right after `-y`. Consequence worth knowing rather than discovering:
`packages/nopy/.nopyrc.json` has always asked for `"verbosity": "trace",
"debug": true`, so a run from that directory now really does get `-vvv --debug`.

The tests move with it — the mock is `execa(file, args, opts)` with no factory
to unwrap, and the new cases are the ones that would have caught this: an argv
element holding `$(id); rm -rf /` stays one element, a secret whose value
contains a quote is masked whole, and `execa` is asserted never to be asked for
a shell.

What remains is not fixable here: the value still reaches pyinfra on its command
line, so it is visible in `ps`. That is pyinfra's `--data` interface.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DCzYTAm9QUhvLNr2EpdagJ

packages/nopy/src/cubes/dependencies.ts

@@ -7,6 +7,7 @@ import type { Cube, CubeVariables, HookContext } from '@bitsquare/nopy-cubes';
 import { getLogger } from '@logtape/logtape';
 import type { Variables } from '../nopy.common.js';
 import type { NopyConfig } from '../nopy.config.js';
+import { logConfigToFlags } from '../nopy.config.js';
 import { NopyUsageError } from '../nopy.errors.js';
 import type { DeployCall } from '../nopy.executor.js';
 import { VariableAssignment } from '../nopy.prompts.js';
@@ -205,6 +206,14 @@ export class BuildContext {
 
   /**
    * Builds and stores a deployment call for a resolved cube
+   *
+   * `command` is a true argv — one array element per argument, nothing
+   * pre-quoted. The executor spawns it without a shell, so a value containing a
+   * space, a quote or a `$(…)` is passed through verbatim instead of being
+   * re-parsed. It used to be a list of fragments joined into one shell string,
+   * which meant any variable value was shell syntax: an SSH password with a `;`
+   * in it ran whatever followed. {@link maskCommand} is the only thing that
+   * turns this back into a string, for display, and quotes as it goes.
    */
   private buildDeployCall(cube: Cube, host: string): void {
     const cubeId = cube.id;
@@ -212,17 +221,17 @@ export class BuildContext {
 
     if (this.resolvedCubes.has(callKey)) return;
 
-    const parts: string[] = [];
+    const parts: string[] = [...logConfigToFlags(this.config.log)];
     if (this.auth.method === 'password' && this.auth.username && this.auth.password) {
-      parts.push(`--user ${this.auth.username} --password ${this.auth.password}`);
+      parts.push('--user', this.auth.username, '--password', this.auth.password);
     }
 
     const cubeVars = this.variables.get(cubeId);
     Object.entries(cubeVars).forEach(([key, value]) => {
-      parts.push(`--data "${key}=${value}"`);
+      parts.push('--data', `${key}=${value}`);
     });
 
-    parts.push(`--chdir ${cube.dir}`);
+    parts.push('--chdir', cube.dir);
     parts.push(`${cube.dir}/${cube.deployScript}`);
 
     const command = ['pyinfra', host, '-y', ...parts];