fix: sanitize subprocess call in simulation_runner.py

[orbisai0security]

Summary

Fix critical severity security issue in backend/app/services/simulation_runner.py.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	backend/app/services/simulation_runner.py:438

Description: The simulation runner spawns OS subprocesses via subprocess.Popen at line 438. User-controlled parameters from the simulation API (entity_types_str at simulation.py:66, project_id at simulation.py:797) flow into the simulation execution pipeline without confirmed sanitization. If these values are incorporated into subprocess command arguments using string concatenation or with shell=True, an attacker can inject shell metacharacters to execute arbitrary operating system commands on the server.

Changes

• backend/app/services/simulation_runner.py
• backend/pyproject.toml

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security