chore: update architecture.md and add test helper guards

- Document execFile usage in cloneRepo and installPackages operations
- Add null guards to getLastJsonOutput and getWrittenPackageJson test
  helpers so failures produce clear messages instead of JSON parse errors

Author: fernandomg

architecture.md

@@ -82,9 +82,9 @@ Plain async functions with no UI dependencies. Each operation receives explicit
 
 | Function | What it does |
 |---|---|
-| `cloneRepo(projectName)` | Shallow clone, checkout latest tag, rm .git, git init |
+| `cloneRepo(projectName)` | Shallow clone, checkout latest tag, rm .git, git init. Uses `execFile` (no shell) for all commands except `git checkout $(...)` which needs shell substitution. |
 | `createEnvFile(projectFolder)` | Copy .env.example to .env.local |
-| `installPackages(projectFolder, mode, features)` | Full: `pnpm i`. Custom: `pnpm remove` deselected packages + postinstall |
+| `installPackages(projectFolder, mode, features)` | Full: `pnpm i`. Custom: `pnpm remove` deselected packages + postinstall. Uses `execFile` exclusively (no shell). |
 | `cleanupFiles(projectFolder, mode, features)` | Remove files/folders for deselected features, patch package.json scripts, remove .install-files |
 
 ### Shell Execution (`source/operations/exec.ts`)

source/__tests__/nonInteractive.test.ts

@@ -29,7 +29,10 @@ const { projectDirectoryExists } = await import('../utils/utils.js')
 
 function getLastJsonOutput(): Record<string, unknown> {
   const lastCall = mockLog.mock.calls.at(-1)
-  return JSON.parse(lastCall?.[0] as string)
+  if (!lastCall) {
+    throw new Error('console.log was never called — no JSON output to read')
+  }
+  return JSON.parse(lastCall[0] as string)
 }
 
 describe('nonInteractive — validation', () => {

source/__tests__/operations/cleanupFiles.test.ts

@@ -34,8 +34,10 @@ function getExecCommands(): string[] {
 
 function getWrittenPackageJson(): Record<string, unknown> {
   const lastCall = vi.mocked(writeFileSync).mock.calls.at(-1)
-  const content = lastCall?.[1] as string
-  return JSON.parse(content)
+  if (!lastCall) {
+    throw new Error('writeFileSync was never called — no package.json to read')
+  }
+  return JSON.parse(lastCall[1] as string)
 }
 
 describe('cleanupFiles', () => {