fix: Refactor tarball creation to use execFileSync

[odaysec]

To safely fix the problem, we should avoid passing shell-constructed string commands to execSync, and instead use APIs that accept arguments as an array, preventing unwanted shell interpretation. For Node.js, child_process.execFileSync allows us to execute commands directly with arguments, bypassing shell parsing. The solution is to replace:

execSync(`yarn pack --filename ${tarballPath}`, { ... });

with:

execFileSync('yarn', ['pack', '--filename', tarballPath], { ... });

1. Update the imports to include execFileSync from child_process.
2. Change the corresponding line inside the per-project loop (line 109) to use execFileSync instead of execSync, providing the arguments array.
3. No additional sanitation needed as execFileSync passes arguments safely.

How has it been tested?

• Unit tests
• Interaction tests
• Pseudo State tests
• Manual - Web
• Manual - Android (Emulator / Device)
• Manual - iOS (Emulator / Device)

Testing instructions

Illustrations/Icons Checklist

Required if this PR changes files under packages/illustrations/** or packages/icons/**

• verified visreg changes with Terran (include link to visreg run/approval)
• all illustration/icons names have been reviewed by Dom and/or Terran

Change management

type=routine
risk=low
impact=sev5

automerge=false

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 1 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2
CODEOWNERS	🟡 See below

🟡 CODEOWNERS

Code Owner	Status	Calculation
ui-systems-eng-team	🟡 0/1	Denominator calculation Additional CODEOWNERS Requirement Show calculation Sum 0 0 From CODEOWNERS 1 Sum 1