fix: prevent shell injection in python hooks

[echobt]

Description

This PR addresses a shell command injection vulnerability in install_droid() where python hook paths were directly interpolated into command strings using format!. If the path contained shell metacharacters, it could lead to arbitrary command execution.

Fix

• Changed the command execution from a string (which is parsed by the shell) to an array of arguments (which is passed directly to the process).
• Replaced format!("python3 \"{}\"", path.display()) with ["python3", path.display().to_string()].

Verification

• This change ensures that the path is treated as a single argument to python3, preventing any shell interpretation of special characters within the path.
• Existing tests passed.