Workflow-step verifier test fixture breaks when the checkout path contains whitespace (4 failures on macOS) #5360

Summary

tests/test_workflow_step_submission.py::test_fetch_keeps_malicious_text_in_one_argument_even_if_validation_is_bypassed fails 4 times (one per parametrized suffix) when the spec-kit checkout lives under a path containing whitespace, e.g. ~/Downloads/GitHub Contribution/spec-kit:

E   step_submission_verifier.Blocked: cannot download https://...: [Errno 2] No such file or directory: 'curl'

Root cause

The fixture writes its fake curl with a #!{sys.executable} shebang. On macOS the XNU kernel splits the shebang line on whitespace, so an interpreter path like /Users/me/Downloads/GitHub Contribution/spec-kit/.venv/bin/python is parsed as interpreter /Users/me/Downloads/GitHub with argument Contribution/... — execve fails with ENOENT and the test reports "No such file or directory: 'curl'".

GitHub CI never sees this (runner paths have no spaces), but any contributor cloning into a directory with a space in the name — common on desktop OSes — hits it. The repo already solves this exact problem elsewhere: _ensure_test_python_on_path() in tests/extensions/test_extension_agent_context.py and make_python3_path_shim() in tests/parity_helpers.py both route through #!/usr/bin/env sh with shlex.quoted interpreter paths.

Suggested fix

Apply the same established pattern in this fixture: write a #!/bin/sh wrapper that execs the quoted interpreter with -c and the quoted Python payload. With -c, sys.argv[1:] is exactly the argument list curl was invoked with, so the test's assertions (len(args) == 14, args[-1] == url) are unchanged.

Minimal repro of the kernel behavior (outside the test suite):

mkdir -p "/tmp/space test"
printf '#!/tmp/space test/python\nprint(1)\n' > /tmp/script
chmod +x /tmp/script
ln -s "$(command -v python3)" "/tmp/space test/python"
/tmp/script   # macOS: [Errno 2] No such file or directory

Observed on macOS 15 (Apple Silicon), Python 3.12.16, spec-kit main at 08252af.

AI disclosure

Issue filed after diagnosis performed with AI assistance: OpenCode running GLM 5.3 Flash (Z.ai), agent mode under human supervision by @mehdikarimi55; reproduction, root-cause analysis (macOS shebang splitting), and verification of the sh-wrapper fix.