fix(shared): harden ripgrep-cli, zip-extractor, binary-downloader subprocess paths

Same Web-Response-on-Node hazard existed in ripgrep auto-download flow,
zip extraction helpers, and binary downloader streams. Switch to the new
Node-safe reader and ensure no spawn path escapes as unhandledRejection.

Related to #3919.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/shared/zip-entry-listing/read-zip-symlink-target.ts

@@ -1,4 +1,5 @@
 import { spawn } from "../bun-spawn-shim"
+import { readProcessStream } from "../process-stream-reader"
 
 export async function readZipSymlinkTarget(
 	archivePath: string,
@@ -11,8 +12,9 @@ export async function readZipSymlinkTarget(
 
 	const [exitCode, stdout, stderr] = await Promise.all([
 		proc.exited,
-		new Response(proc.stdout).text(),
-		new Response(proc.stderr).text(),
+		// #3919: Use Buffer-concat stream reads for Node utility-process compatibility.
+		readProcessStream(proc.stdout),
+		readProcessStream(proc.stderr),
 	])
 
 	if (exitCode !== 0) {