🐛 Quote the file path in the Open File action on Linux - #1603

On Linux the Open File action builds the command xdg-open "${action.path}", and exec() runs it through a shell (spawn(command, [], { shell: true })). Double quotes do not stop the shell from expanding $, backticks or \, and a " in the path ends the quoted string early. For an Open File item pointing at:

• /home/user/$HOME-notes.txt, the shell expands $HOME and the wrong path is opened.
• /home/user/Budget "2026".pdf, the shell joins it to Budget 2026.pdf.
• /home/user/$(touch marker).txt, the touch command is run.

This wraps the path in single quotes and escapes any single quote inside it (as '\''), so the path reaches xdg-open unchanged. macOS and Windows use shell.openPath and are not affected.

I added test/unit-tests/open-file.spec.ts. It puts a fake xdg-open first on the PATH, runs the action, and checks that the script receives the path exactly as given (plain, spaces, $HOME, double quote, single quote, backtick, backslash). It also checks that a $(touch ...) in the path does not create the marker file. The spec is skipped on non-Linux platforms. I also added a line to the Fixed section of the changelog.

I did not run anything locally. I checked it in CI on my fork:

• Test only (commit 214b507): the Tests job fails with 117 passing and 4 failing, for example AssertionError: expected '/home/user//home/runner-notes.txt' to equal '/home/user/$HOME-notes.txt', expected '/home/user/Budget 2026.pdf' to equal '/home/user/Budget "2026".pdf', and expected true to equal false for the marker file. Run: https://github.com/ChandraChaan/kando/actions/runs/41588416222. The End-to-End Tests job also failed in that run, in cli.spec.ts and settings-persistence.spec.ts with unexpected value "no-transitions hidden". Those specs do not touch this code and they passed on the fix commit, so I think they are flaky.
• With the fix (commit 4e3c76b): Tests (121 passing), ESLint, TypeScript Check, Prettier, REUSE and End-to-End Tests all pass. Run: https://github.com/ChandraChaan/kando/actions/runs/41588417216