Developer helpers interpolate values into shell strings

Two developer helpers build shell strings out of interpolated values. `bin/example-image` runs ``git -C #{REPO} ls-files #{gem}`` in backticks, so a checkout path containing shell metacharacters executes on the developer's or CI host; a path with spaces merely breaks parsing. `bin/load` interpolates the scenario, duration, and thread count into a `bash -c` string that runs inside the networked root driver container.

Severity is low because these values are operator-controlled in normal use and neither script is on the production conversion path. It is still an unnecessary pattern in a security project, and the checkout path is not always chosen by the person running the script.

## Fix direction

- Use argv form: `Open3.capture2e("git", "-C", REPO, "ls-files", "--", gem)` or equivalent.
- In `bin/load`, pass arguments as positional parameters after a constant shell program, validate the numeric inputs, and pin the driver image.

Production tool execution already uses argv-form `Open3.popen3`; the assessment specifically refuted Semgrep's shell-injection warning there.

`HC-PT-014` of the purple-team assessment of 2026-08-22, rated Low.

Start with bin/example-image and bin/load, then compare their command execution with the production argv-form Open3.popen3 usage described in the issue. Replace interpolated command values with argument passing, validate the numeric load inputs, and pin the driver image; done means these helpers no longer construct shell commands from those values.

Written by the indexing model from the issue text.