feat: implement safe dev process orchestration

[dDevAhmed]

Summary

Implements CLI-031 with a security-first stellarforge dev MVP for supported generated Node.js projects.

This PR is temporarily stacked on CLI-030 so the generated-project conventions remain available while the earlier PRs complete repository-level gates.

Included

• registers stellarforge dev
• switches root CLI execution to Commander parseAsync
• resolves supported project scripts from validated package.json structure
• invokes npm using executable + argument arrays rather than executing package script text directly
• supervises child processes with shell: false
• prefixes stdout/stderr by process label
• filters inherited environment variables to an explicit allowlist
• excludes arbitrary secrets and NODE_OPTIONS
• handles SIGINT/SIGTERM and removes handlers deterministically
• terminates sibling processes after startup/runtime failure
• actionable validation/subprocess errors
• deterministic fake-child tests for clean exit, startup failure, unexpected exit, SIGINT and SIGTERM

Security

• no shell command interpolation
• no command strings from project metadata are executed directly
• no broad process.env inheritance
• no environment dump in logs/errors
• child cleanup is centralized and tested

Closes #34