fix: prevent shell injection in pre-push hook environment loading

[daniel-lxs]

Fixes shell injection vulnerability in pre-push hook environment loading.

Problem:
The original export $(grep -v '^\#' .env.local | xargs) pattern was vulnerable to shell injection. Malicious content in .env.local like RUN_TESTS_ON_PUSH=true; rm -rf / could execute arbitrary commands.

Solution:
Uses the existing @dotenvx/dotenvx dependency to securely parse .env.local without shell evaluation:

• npx dotenvx get safely extracts specific variables
• npx dotenvx run executes commands with environment loaded securely
• Eliminates shell injection attack vectors while maintaining functionality

Security Benefits:

• No shell evaluation of .env.local contents
• Prevents execution of embedded commands or scripts
• Uses established, secure dotenv parsing library
• Maintains backward compatibility with existing behavior

[roomote]

Rooviewer   See task on Roo Cloud

Review complete. The shell injection vulnerability has been resolved by replacing the unsafe pattern with dotenvx.

• The source .env.local command still executes the file as shell code, allowing malicious commands to run

Previous reviews

• e55b260: Review #1

_{Mention @roomote to ask your PR Fixer agent to address the feedback.}