fix: run agent commands through a verified MCP launcher

[JJasonSun]

Agent skills can select the SDK's shared calle binary, and interpolating user text or opaque call IDs into shell commands can execute or corrupt those values. The five skills now use a bundled launcher that verifies a trusted @call-e/cli package and its command help before forwarding a JSON argument array with shell: false.

The launcher accepts a request file or stdin and applies integration attribution through the child process environment. The same documented command runs in Bash, PowerShell, and cmd. CLI responses include login_argv, help_argv, and next_argv for exact follow-up execution; existing command-string fields remain available for display. Packaged skills, installation guides, CLI references, and version checks follow this contract.

Fixes #109.

Validation:

• Linux and Windows CI passed at 4cf11b6ffe1b3a2ed9c67a278f1c2956739e7add. Linux passed 169 JavaScript tests, with one Windows-only skip, plus 8 Python OAuth tests. Windows passed 100 CLI tests with no skips.
• Executed 67 documented argument arrays in Bash and all 67 in each of PowerShell 7, Windows PowerShell, and cmd. Verified help, authentication/readiness, call/recovery flows, attribution, and Unicode paths against a local broker/MCP server.
• Installed @call-e/calle@0.7.0 and @call-e/cli@0.5.0 together, reproduced npm selecting the SDK, and exercised the candidate CLI source in that installation. Wrong package identity and incompatible help fail before request arguments are forwarded; neither the SDK nor an earlier calle on PATH receives authentication or confirmation arguments.
• Adversarial quotes, command substitutions, backticks, backslashes, newlines, and Chinese text reach the fake server unchanged. Lost-response recovery accepts one logical call, and no injected command runs.
• pnpm check, pnpm pack:dry-run, git diff --check, and isolated release-version synchronization passed. Test calls use synthetic credentials and a local server.

Includes patch changesets for @call-e/cli, @call-e/codex-plugin, @call-e/claude-plugin, and @call-e/cursor-plugin. OpenClaw and skills.sh receive the synchronized launcher and guidance through their existing repository distribution.

[Ray-56]

Requesting changes on the exact current head (826905b). The package-selection direction is safer than a bare executable, but the agent-facing command contract is still unsafe and incomplete:

• [P1] Do not interpolate dynamic values into shell command templates. The synchronized command references place the latest user message verbatim inside single-quoted JSON and place remote plan_id, confirm_token, run_id, and recovery values inside double quotes. A U+0027 quote can break the JSON/shell boundary, while $() and backticks are still executable inside double quotes. This can turn an ordinary call request or server-returned opaque value into local command execution or argument corruption before the verified CLI starts. Require shell-free argv execution for every dynamic value, using JSON.stringify plus spawn/execFile with shell:false, or add a file/stdin input that avoids shell interpolation. Add adversarial quote, command-substitution, backtick, backslash, and newline tests and assert that no injected process runs and exact arguments reach only the verified entry.
• [P1] The new mandatory entry syntax still blocks Windows PowerShell. The packaged skills continue to prefix commands with POSIX env NAME=value, and the newly expanded standalone guidance uses node "$CALLE_CLI_ENTRY"; stock PowerShell has no env command and reads environment variables as $env:CALLE_CLI_ENTRY. This is already reproduced in #111, and this PR replaces previously runnable bare CLI examples with the incompatible form. Provide a cross-platform launcher or explicit Bash, PowerShell, and cmd forms selected before execution, fail closed for unknown shells, and add a Windows CI job that runs literal help/auth-status/no-call readiness commands while preserving attribution.
• [P2] Automate the acceptance cases required by #109. The E2E test reads the repository copy of @call-e/cli and shadows PATH with a fake calle, but it does not install/exercise @call-e/calle alongside it and has no runtime wrong-package-identity or incompatible-help fail-closed case. Add those fixtures and assert that no auth or confirmation argument reaches either the conflicting SDK binary or a mismatched executable.

The exact head has green GitHub CI and passes pnpm check, pnpm test, and pnpm pack:dry-run locally with pnpm 10.18.3, but the P1 findings block merge. Release decision: patch changesets for @call-e/cli and the three published plugins are appropriate; the private OpenClaw/skills.sh validation packages need no changeset.