Potential fix for code scanning alert no. 2: Second order command injection

[daddia]

Potential fix for https://github.com/carinyaparc/carinyaparc/security/code-scanning/2

To fix this safely without changing functionality, ensure user-influenced ref arguments are always passed after Git’s end-of-options marker -- for commands that accept refs (fetch, checkout). This prevents Git from interpreting attacker-controlled strings as flags even if validation is bypassed or changed later.

Best single fix in this snippet:

• In packages/crew/src/workspace.ts, update:
  • line 116 ['fetch', 'origin', branch] → ['fetch', 'origin', '--', branch]
  • line 117 ['checkout', '-b', branch, \origin/${branch}`]→['checkout', '-b', branch, '--', `origin/${branch}`]`
  • line 123 ['checkout', '-b', branch] → ['checkout', '-b', branch, '--']

This is defense-in-depth and keeps existing branch validation logic intact.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.