fix(shared): harden ripgrep-cli, zip-extractor, binary-downloader subprocess paths

Same Web-Response-on-Node hazard existed in ripgrep auto-download flow,
zip extraction helpers, and binary downloader streams. Switch to the new
Node-safe reader and ensure no spawn path escapes as unhandledRejection.

Related to #3919.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/shared/zip-entry-listing/zipinfo-zip-entry-listing.ts

@@ -1,6 +1,7 @@
 import { spawn, spawnSync } from "../bun-spawn-shim"
 
 import type { ArchiveEntry } from "../archive-entry-validator"
+import { readProcessStream } from "../process-stream-reader"
 import { readZipSymlinkTarget } from "./read-zip-symlink-target"
 
 export function parseZipInfoListedEntry(line: string): ArchiveEntry | null {
@@ -45,8 +46,9 @@ export async function listZipEntriesWithZipInfo(
 
 	const [exitCode, stdout, stderr] = await Promise.all([
 		proc.exited,
-		new Response(proc.stdout).text(),
-		new Response(proc.stderr).text(),
+		// #3919: Use Buffer-concat stream reads for Node utility-process compatibility.
+		readProcessStream(proc.stdout),
+		readProcessStream(proc.stderr),
 	])
 
 	if (exitCode !== 0) {