fix(producer): pass stub formatter path as an argument

[jrusso1020]

A checkout path containing shell metacharacters could execute commands when the producer formats its generated early stub (CodeQL #447). Invoke bun x oxfmt with an argument array so the full output path stays data. bunx is the documented alias for bun x: https://bun.sh/docs/pm/bunx.

Generated stub contents, formatter selection, and the existing nonfatal formatter-failure behavior are preserved.

Validation:

• Executed the actual build script in a temporary checkout path containing spaces, semicolons, and a shell comment. The original code executed a controlled marker command; the fix passed the entire path as one argument and did not execute it.
• Compared generated bytes across baseline, fixed, and failing-formatter runs: identical. Formatter failure still exits successfully.
• Normal generator invocation, changed-file oxlint/oxfmt, and full workspace build pass.

Native CI and independent review are required before merge.

[jrusso1020]

Superseded by merged PR #3834 (db51d54): the producer now calls formatGeneratedSource, which invokes bun x oxfmt through execFileSync with an argument array. The vulnerable shell interpolation is gone. Code-scanning alert #447 is independently verified fixed on main at 2026-09-10T03:20:05Z. Closing this redundant PR without merging; preserving the branch/worktree.