Validate quality-gate subprocess path arguments against a safe allowlist, resolve them inside the project root, and require referenced paths to exist before command execution.
Harden the command-injection regression feature so it loads the script reliably, avoids generic Behave step collisions, verifies path arguments are resolved before subprocess execution, and carries the mandatory TDD issue tag.
ISSUES CLOSED: #7286
HAL9000