bug: Every program creates files with `com.apple.provenance` extended attribute

### Checks

- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again

### Operating system

macOS Sequoia 15.4

### Expected behaviour

When running a program that produces files/directories:

- `touch foo`
- `mkdir bar`
- `echo baz >baz`

It should creates files/directories without `com.apple.provenance` attribute, just like it does when it's executed directly from the shell with no q session in-between.

### Actual behaviour

It creates files/directories with `com.apple.provenance` attribute.

### Steps to reproduce

1. `touch foo`
1. `xattr -l foo`
1. It would print `com.apple.provenance:`

Also confirmed that `brew uninstall amazon-q` resolves this issue.

### Environment

```yaml
[q-details]
version = "1.7.2"
hash = "b6bf5f1675dd7395009e8bc65c1145820671f211"
date = "2025-03-21T01:36:16.66764Z (15d ago)"
variant = "full"

[system-info]
os = "macOS 15.4.0 (24E248)"
chip = "Apple M1"
total-cores = 8
memory = "16.00 GB"

[environment]
cwd = "/Users/USER"
cli-path = "/Users/USER"
os = "Mac"
shell-path = "/bin/zsh"
shell-version = "5.9"
terminal = "iTerm 2"
install-method = "brew"

[env-vars]
PATH = "/Users/USER/Library/pnpm:/opt/homebrew/share/google-cloud-sdk/bin:/Users/USER/.local/state/fnm_multishells/85158_1743839409699/bin:/opt/homebrew/opt/zip/bin:/opt/homebrew/opt/unzip/bin:/opt/homebrew/opt/openjdk/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/Users/USER/.bzl/bin:/Users/USER/.pot/bin:/Users/USER/proj/include-what-you-use/install/bin:/Users/USER/.local/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Library/Apple/usr/bin:/usr/local/share/dotnet:~/.dotnet/tools:/Users/USER/.cargo/bin:/Applications/iTerm.app/Contents/Resources/utilities:/Users/USER/Library/Caches/antidote/unixorn/git-extra-commands/bin"
QTERM_SESSION_ID = "26a366783b8b41eca2c30635e45a2432"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "1.7.2"
SHELL = "/bin/zsh"
TERM = "xterm-256color"
__CFBundleIdentifier = "com.googlecode.iterm2"
```

Riproduci questo in una sessione q su macOS 15.4 usando `touch foo`, `mkdir bar` ed `echo baz > baz`, quindi esamina ogni risultato con `xattr -l`; confronta con l’esecuzione diretta dalla shell e dopo `q restart`. Traccia il modo in cui la sessione q avvia i programmi e propaga lo stato dei processi macOS. Il lavoro è completo quando quei comandi non creano più `com.apple.provenance`, mentre il comportamento diretto della shell rimane invariato.

Scritto dal modello di indicizzazione a partire dal testo della issue.