fix(shared): harden ripgrep-cli, zip-extractor, binary-downloader subprocess paths

Same Web-Response-on-Node hazard existed in ripgrep auto-download flow,
zip extraction helpers, and binary downloader streams. Switch to the new
Node-safe reader and ensure no spawn path escapes as unhandledRejection.

Related to #3919.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/shared/zip-entry-listing/tar-zip-entry-listing.ts

@@ -2,6 +2,7 @@ import { spawn } from "../bun-spawn-shim"
 
 import type { ArchiveEntry } from "../archive-entry-validator"
 import { log } from "../logger"
+import { readProcessStream } from "../process-stream-reader"
 
 
 
@@ -81,8 +82,9 @@ export async function listZipEntriesWithTar(
 
 	const [exitCode, stdout, stderr] = await Promise.all([
 		proc.exited,
-		new Response(proc.stdout).text(),
-		new Response(proc.stderr).text(),
+		// #3919: Use Buffer-concat stream reads for Node utility-process compatibility.
+		readProcessStream(proc.stdout),
+		readProcessStream(proc.stderr),
 	])
 
 	if (exitCode !== 0) {