Security: sanitize model names in shell calls

## Background
Model names may reach a shell via subprocess.

## Why it matters
Command injection risk.

## Acceptance criteria
- [ ] Audit for shell interpolation of model names; use argument lists, never string shells.
- [ ] Add a security test.

## Where to look
- `src/modeldock/adapters/`, `common/`

## How to claim
Comment `/claim` on this issue.