Clarify that CVE request is a security advisory action, not a repository change

[Copilot]

The issue asked to finalize the OS command injection fix by requesting a CVE for the associated GitHub Security advisory. This is an operational GitHub security workflow step, not a source change in the repository.

• Scope

  • Confirmed the command-injection patch is already present in the codebase.
  • Confirmed the requested CVE action is handled in GitHub Security, outside repository contents.

• Repository impact

  • No code, test, or documentation files were changed.
  • The PR exists to record that no repository-side modification was required for this issue.

• Result

  • The issue is resolved by the advisory-side action already marked as done, with no additional repo change needed.