fix(aibox): close audit findings H1-H3/M1-M2 (command exec protection chain)

- H1: CommandLineTool.execute_streaming now purely delegates to injected
  executor; removes 150-line duplicate Popen loop that bypassed 1MB cap,
  cancel() and timeout protections
- H2: thread the blocking readline into a daemon reader thread; main loop
  polls queue with 0.1s ticks so timeout/1MB checks fire even for silent
  commands (verified: 3s timeout on 15s sleep, was 15s+ before)
- H3: stdin=DEVNULL on both Popen sites; stdin-waiting commands now hit
  EOF instead of deadlocking the tool thread forever
- M1: heredoc delimiter uniquification in write_file guidance (content
  line equal to AIBOX_EOF no longer truncates into shell injection)
- M2: 3600s total deadline on registry streaming forward loop

Verification: PoC regression 5/5 PASS (timeout/1MB/cancel/delegation),
full unit suite 264 passed. Audit report updated with Batch E results.

aibox/tools/basic_tools.py

@@ -175,8 +175,15 @@ class WriteFileTool(FileToolBase):
         dir_cmd = f"mkdir -p {shlex.quote(directory)}" if directory else ""
 
         # 内容写入使用 heredoc，避免引号/特殊字符转义问题
+        # M1 修复（审计 2026-08-17）：定界符唯一化——若 content 中含独立行
+        # 与定界符相同（如 "AIBOX_EOF"），heredoc 会提前终止，其后内容被
+        # 当作 shell 命令执行（注入）。冲突时递增后缀直到唯一。
+        delimiter = "AIBOX_EOF"
+        content_lines = {line.strip() for line in content.split("\n")}
+        while delimiter in content_lines:
+            delimiter += "_X"
         redirect = ">" if mode == "w" else ">>"
-        write_cmd = f"cat {redirect} {quoted} <<'AIBOX_EOF'\n{content}\nAIBOX_EOF"
+        write_cmd = f"cat {redirect} {quoted} <<'{delimiter}'\n{content}\n{delimiter}"
         if dir_cmd:
             write_cmd = f"{dir_cmd} && {write_cmd}"