fix(security): harden verifier command execution

[Canvinus]

Summary

• Replace verifier near and Git shell-string calls with argument-based execFile(..., shell: false).
• Validate networkId, NEAR account IDs, source snapshot URLs, and full 40-character commit SHA pins before executing verifier or Git commands.
• Checkout source snapshots detached at the pinned commit SHA; branch names, tags, and short SHAs are rejected to keep verification immutable.
• Add command timeout/output limits and clean up temporary clone folders on IPFS/pinning failures.

Validation

• Disposable Docker container (node:22-alpine, repo mounted read-only then copied inside):
  • npm ci --ignore-scripts --no-audit --no-fund
  • npm run build
  • npm test -- --runInBand
  • npx eslint "{src,apps,libs,test}/**/*.ts"
• git diff --check

[Canvinus]

@codex

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b05111e5df

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve checkout of non-default branch refs

For source snapshots whose rev names a non-default branch (for example the feature/repro-build ref accepted by the new tests), a normal git clone only creates a local branch for the default branch and leaves other branches under origin/…; git checkout --detach feature/repro-build then invokes Git's remote-branch guessing, which fails because --detach is incompatible with creating the guessed tracking branch. This regresses branch-based snapshots that the old git checkout <ref> script could check out, so those contracts now fail pre-verification/IPFS checkout even though the parser still accepts the ref.

Useful? React with 👍 / 👎.