chore: ban direct child_process and shell:true outside the subprocess tool

packages/@aws-cdk-testing/cli-integ/lib/cli/stage-distribution.ts

@@ -108,6 +108,7 @@ async function main() {
         await usageDir.activateInCurrentProcess();
 
         await shell(args.COMMAND ?? [], {
+          // eslint-disable-next-line no-restricted-syntax -- cli-integ deliberately runs commands through a shell to mimic real terminal invocation in integ tests.
           shell: true,
           show: 'always',
         });

packages/@aws-cdk-testing/cli-integ/lib/npm.ts

@@ -1,3 +1,4 @@
+// eslint-disable-next-line no-restricted-imports -- cli-integ is a test harness that spawns processes to exercise the CLI as a user would; it is test infrastructure, not shipped runtime.
 import { spawnSync } from 'child_process';
 import * as semver from 'semver';
 import { shell } from './shell';

packages/@aws-cdk-testing/cli-integ/lib/package-sources/repo-tools/npm.ts

@@ -1,3 +1,4 @@
+// eslint-disable-next-line no-restricted-imports -- cli-integ is a test harness that spawns processes to exercise the CLI as a user would; it is test infrastructure, not shipped runtime.
 import * as child_process from 'child_process';
 import * as fs from 'fs-extra';
 

packages/@aws-cdk-testing/cli-integ/lib/process.ts

@@ -1,3 +1,4 @@
+// eslint-disable-next-line no-restricted-imports -- cli-integ is a test harness that spawns processes to exercise the CLI as a user would; it is test infrastructure, not shipped runtime.
 import * as child from 'child_process';
 import type { Readable, Writable } from 'stream';
 import * as pty from 'node-pty';
@@ -63,6 +64,7 @@ export class Process {
     // (passing args with shell: true is deprecated because they are not escaped).
     const fullCommand = [command, ...args].join(' ');
     const process = child.spawn(fullCommand, [], {
+      // eslint-disable-next-line no-restricted-syntax -- cli-integ deliberately runs commands through a shell to mimic real terminal invocation in integ tests.
       shell: true,
       stdio: ['ignore', 'pipe', 'pipe'],
       ...options,

packages/@aws-cdk-testing/cli-integ/lib/shell.ts

@@ -1,3 +1,4 @@
+// eslint-disable-next-line no-restricted-imports -- type-only import in cli-integ, a test harness that spawns processes to exercise the CLI; test infrastructure, not shipped runtime.
 import type * as child_process from 'child_process';
 import * as fs from 'fs';
 import * as os from 'os';

packages/@aws-cdk-testing/cli-integ/lib/with-cdk-app.ts

@@ -518,6 +518,7 @@ export class TestFixture extends ShellHelper {
       '--username', username,
       '--password', '${ECR_PASSWORD}',
       'public.ecr.aws'], {
+      // eslint-disable-next-line no-restricted-syntax -- cli-integ deliberately runs commands through a shell to mimic real terminal invocation in integ tests.
       shell: true,
       modEnv: {
         ECR_PASSWORD: password,

packages/@aws-cdk-testing/cli-integ/lib/with-sam.ts

@@ -1,3 +1,4 @@
+// eslint-disable-next-line no-restricted-imports -- cli-integ is a test harness that spawns processes to exercise the CLI as a user would; it is test infrastructure, not shipped runtime.
 import * as child_process from 'child_process';
 import * as os from 'os';
 import * as path from 'path';
@@ -192,6 +193,7 @@ export async function shellWithAction(
     ...options,
     env,
     // Need this for Windows where we want .cmd and .bat to be found as well.
+    // eslint-disable-next-line no-restricted-syntax -- cli-integ deliberately runs commands through a shell to mimic real terminal invocation in integ tests.
     shell: true,
     stdio: ['ignore', 'pipe', 'pipe'],
   });