refactor(backup)!: run argv lists, never a shell

The backup built command strings and handed them to shell=True, so four interpolated values per dump - user, password, container, database - were each a way out of the command. validate_database covered one of them since the previous commit; now there is nothing to cover: every command is an argv list, and a value can only ever be an argument.

execute_to_file absorbs the atomic dump write. The shell redirect into <file>.tmp and the separate mv process become a Python file handle and os.replace, and a failing dump deletes its partial file instead of leaving it. PGPASSWORD moves out of the command string into the child's environment, where a process listing does not show it.

docker exec is built in one place, docker_exec_argv; db.py's three hand-built copies and the probe use it. The dead docker_volume_exists goes - never called, and the restore side owns the living twin. The rsync quoting in --link-dest falls away: inside an argv it would have become part of the path.

The snapshot module's injected runner changes type with it, which the three e2e drivers implement - the first conversion missed them, btrfs ran with no arguments, and the e2e caught it. Marked breaking for that contract: any external runner injected into volume_snapshot must now accept a list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/baudolo/backup/volume.py

@@ -30,7 +30,7 @@ class Backing:
 
 def inspect_backing(volume_name: str) -> Backing:
     reported = execute_shell_command(
-        f"docker volume inspect --format '{{{{json .}}}}' {volume_name}"
+        ["docker", "volume", "inspect", "--format", "{{json .}}", volume_name]
     )[0]
     data = json.loads(reported)
     return Backing(
@@ -73,13 +73,12 @@ def backup_volume(
     pathlib.Path(dest).mkdir(parents=True, exist_ok=True)
 
     last = get_last_backup_dir(versions_dir, volume_name, dest)
-    link_dest = f"--link-dest='{last}'" if last else ""
-    verify = "--checksum " if authoritative else ""
-
-    cmd = (
-        f"rsync -aP --no-D --delete --delete-excluded "
-        f"{verify}{link_dest} {source} {dest}"
-    )
+    cmd = ["rsync", "-aP", "--no-D", "--delete", "--delete-excluded"]
+    if authoritative:
+        cmd.append("--checksum")
+    if last:
+        cmd.append(f"--link-dest={last}")
+    cmd += [source, dest]
 
     try:
         execute_shell_command(cmd)