chore: satisfy Codacy's subprocess checks on the new test runner

Codacy runs Bandit and Opengrep (its Semgrep fork). The new
subprocess.run in scripts/run_plugin_tests.py trips three patterns, on
two different lines:

  Bandit   B404 on the import, B603 on the call
  Opengrep dangerous-subprocess-use-audit          on the run( line
           dangerous-subprocess-use-tainted-env-args on the argv line

A nosemgrep applies only to its own line, so the call line and the argv
line each need one; a single comment on the call covered neither rule
fully. Suppression is the right answer here rather than a rewrite: the
interpreter is sys.executable, the arguments are a list, and no shell is
involved, so there is nothing to word-split or expand.

Matches the pair the rest of the repo already uses for this shape --
permission_utils.py, plugin_loader.py, install_dependencies_apt.py.

Codacy: 0 new issues, up to standards.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014RRtqXDCnvnY6EQwhT5CV9

scripts/run_plugin_tests.py

@@ -8,7 +8,7 @@ Supports both unittest and pytest.
 
 import os
 import re
-import subprocess  # nosec B404 - runs repo-local test files, never a shell
+import subprocess  # nosec B404 - list-form argv only, no shell  # nosemgrep
 import sys
 import argparse
 from pathlib import Path
@@ -111,13 +111,16 @@ def run_script_tests(test_files: list, verbose: bool = False) -> int:
     failures = []
     for path in test_files:
         try:
-            # nosec B603 - fixed interpreter (sys.executable) plus a test path
-            # this script discovered by globbing the repo; argument list, no
-            # shell, so nothing is word-split or expanded.
-            proc = subprocess.run([sys.executable, str(path)],  # nosec B603
+            # Fixed interpreter (sys.executable) plus a test path this script
+            # discovered by globbing the repo; argument list, no shell, so
+            # nothing is word-split or expanded. Same suppression pair the
+            # rest of the repo uses for this shape (see permission_utils.py).
+            proc = subprocess.run(  # nosec B603 - no shell invoked (list-form argv)  # nosemgrep
+                [sys.executable, str(path)],  # nosemgrep
                 cwd=str(Path(path).parent),
                 capture_output=True, text=True, env=env,
-                                  stdin=subprocess.DEVNULL, timeout=300)
+                stdin=subprocess.DEVNULL, timeout=300,
+            )
             rc = proc.returncode
             tail = " | ".join((proc.stdout or proc.stderr or "").strip().splitlines()[-2:])[:200]
         except subprocess.TimeoutExpired: