OpenApp lifecycle: follow-ups from PR #2931 review (non-blocking)

Tracking the non-blocking follow-ups identified during the review of #2931. That PR was approved and merged with these deferred for resolution.

### 1. (MEDIUM) Extend B31's audit-write guard to the Upgrade and Remove paths
PR #2931 wrapped the success-path `RecordInstallHistoryEntry` call in a try/catch **only on the Install flow** ([install-orchestrator.ts](packages/OpenApp/Engine/src/install/install-orchestrator.ts)). The **Upgrade** and **Remove** success-path history writes are still bare — a throw there falls into the outer catch and downgrades a fully-successful upgrade/remove to status `Error`. This is the exact B31 bug on the other two flows.

**Fix:** wrap both with the same try/catch + `OnWarn` pattern used on Install.

### 2. (LOW–MEDIUM) `IsSchemaSharedByOtherApps` fail-safe can mislabel a half-removed app as "Removed"
On a share-check query failure the function returns `true` ("never risk dropping a possibly-shared schema") — the right data-safety direction. But the consequence is metadata + schema removal are skipped, files are then stripped, and the app is marked `Removed` (success). An indeterminate DB query thus yields a "successfully removed" app whose schema/metadata remain and whose files are gone — a B20-class half-removed state, relabeled as success.

**Fix:** treat a failed share-*check* like `removalErrors` (abort before touching the filesystem) rather than silently falling through to file-only removal.

### 3. (LOW) B40 — prefer `execFileSync` with an args array over `execSync` + denylist
The custom-registry-URL validation (protocol allowlist + shell-metacharacter denylist) blocks realistic injection, but feeding `execSync` (a shell) is inherently riskier than `execFileSync(pm, ['install','--registry', url], …)`, which removes shell interpolation as a class of risk. Hardening, not a known exploit.

### 4. (LOW / cosmetic) Stale PR description
#2931's body still describes B19 as "baseline at `'0'`"; the shipped code correctly uses `'1'` (the Skyway sentinel). Noted for the historical record only.

Source: code review of #2931.

Start in packages/OpenApp/Engine/src/install/install-orchestrator.ts and trace the Install, Upgrade, and Remove success paths, including their RecordInstallHistoryEntry calls. Then locate IsSchemaSharedByOtherApps and the custom-registry command validation. Done means audit-write failures no longer downgrade successful flows, share-check failures abort before filesystem changes, and registry execution avoids shell interpolation.

Written by the indexing model from the issue text.