[Fix] Project creation can execute shell commands from project names

[roomote-management]

​Created by Roomote. View the task or mention @roomote for follow-up asks.

Type of change

• Bug fix

Summary of change

• Replace shell-interpolated CLI setup commands with allowlisted, argument-based process execution. Project names and destination paths no longer enter a shell command, while Windows package-manager shims retain explicit support.
• Keep Shopify credentials out of pull-request-controlled install, lint, and formatting commands. Secret-backed builds now run only for trusted pushes, and the workflow token is limited to read-only repository contents.
• Remove the metrics Lambda's unused permission to invoke every Lambda function across accounts and regions.

Why this change was made

The security review found a high-confidence command-injection path in the published starter CLI and excessive credential exposure in CI and AWS IAM defaults. These changes close the directly actionable risks without introducing an arbitrary authentication design into example applications.

Impact

CLI users can safely generate projects whose paths contain shell metacharacters, and the affected automation now follows narrower secret and permission boundaries. There is no intended browser-visible change. Serverless packaging was verified with the configured Node 18 runtime; the older serverless-offline dependency remains incompatible with Node 22.

Checklist

• These changes follow the contributing guidelines
• I have verified the fix works and introduces no further errors

[netlify]

✅ Deploy Preview for starter-dev canceled.

Name	Link
🔨 Latest commit	72e75b7
🔍 Latest deploy log	https://app.netlify.com/projects/starter-dev/deploys/6ab08cacbcc64e000713a81f

[netlify]

✅ Deploy Preview for shopify-next-tailwind canceled.

Name	Link
🔨 Latest commit	72e75b7
🔍 Latest deploy log	https://app.netlify.com/projects/shopify-next-tailwind/deploys/6ab08cace56cba00081050aa