refactor(backup)!: run argv lists, never a shell

The backup built command strings and handed them to shell=True, so four interpolated values per dump - user, password, container, database - were each a way out of the command. validate_database covered one of them since the previous commit; now there is nothing to cover: every command is an argv list, and a value can only ever be an argument.

execute_to_file absorbs the atomic dump write. The shell redirect into <file>.tmp and the separate mv process become a Python file handle and os.replace, and a failing dump deletes its partial file instead of leaving it. PGPASSWORD moves out of the command string into the child's environment, where a process listing does not show it.

docker exec is built in one place, docker_exec_argv; db.py's three hand-built copies and the probe use it. The dead docker_volume_exists goes - never called, and the restore side owns the living twin. The rsync quoting in --link-dest falls away: inside an argv it would have become part of the path.

The snapshot module's injected runner changes type with it, which the three e2e drivers implement - the first conversion missed them, btrfs ran with no arguments, and the e2e caught it. Marked breaking for that contract: any external runner injected into volume_snapshot must now accept a list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/e2e/faithful_driver.py

@@ -23,13 +23,11 @@ from baudolo.backup.volume import Backing
 SUBJECT = sys.argv[1]
 
 
-def shell(command: str) -> list[str]:
-    proc = subprocess.run(
-        command, shell=True, capture_output=True, text=True, check=False
-    )
+def shell(command: list[str]) -> list[str]:
+    proc = subprocess.run(command, capture_output=True, text=True, check=False)
     if proc.returncode != 0:
         raise SnapshotError(
-            f"{command} exited {proc.returncode}: {proc.stderr.strip()}"
+            f"{' '.join(command)} exited {proc.returncode}: {proc.stderr.strip()}"
         )
     return proc.stdout.splitlines()
 
@@ -50,7 +48,7 @@ def volume(name: str, payload: str) -> Path:
 plain = volume("plain", "plain-payload")
 own = Path(SUBJECT) / "volumes" / "own" / "_data"
 own.mkdir(parents=True, exist_ok=True)
-shell(f"mount -t tmpfs tmpfs {own}")
+shell(["mount", "-t", "tmpfs", "tmpfs", own])
 (own / "state").write_text("own-payload")
 
 check("a plain volume is captured", unsnapshotted(Backing(str(plain)), SUBJECT) is None)

tests/e2e/snapshot_db_driver.py

@@ -22,13 +22,11 @@ VERSIONS = "/backups"
 GENERATION = f"{VERSIONS}/20260731"
 
 
-def shell(command: str) -> list[str]:
-    proc = subprocess.run(
-        command, shell=True, capture_output=True, text=True, check=False
-    )
+def shell(command: list[str]) -> list[str]:
+    proc = subprocess.run(command, capture_output=True, text=True, check=False)
     if proc.returncode != 0:
         raise SnapshotError(
-            f"{command} exited {proc.returncode}: {proc.stderr.strip()}"
+            f"{' '.join(command)} exited {proc.returncode}: {proc.stderr.strip()}"
         )
     return proc.stdout.splitlines()
 

tests/e2e/snapshot_driver.py

@@ -19,13 +19,11 @@ SUBJECT = sys.argv[2]
 EXPECT = sys.argv[3]
 
 
-def shell(command: str) -> list[str]:
-    proc = subprocess.run(
-        command, shell=True, capture_output=True, text=True, check=False
-    )
+def shell(command: list[str]) -> list[str]:
+    proc = subprocess.run(command, capture_output=True, text=True, check=False)
     if proc.returncode != 0:
         raise SnapshotError(
-            f"{command} exited {proc.returncode}: {proc.stderr.strip()}"
+            f"{' '.join(command)} exited {proc.returncode}: {proc.stderr.strip()}"
         )
     return proc.stdout.splitlines()