Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/ui/cmds.go`:
- Line 105: The openURI function currently constructs the command with
exec.Command("cmd", "/c", "start", uri) which routes unescaped user URIs through
cmd.exe and allows shell metacharacter interpretation; change this to invoke
Windows directly (e.g., use exec.Command("rundll32",
"url.dll,FileProtocolHandler", uri)) so the URI is opened without cmd.exe
parsing, or if you must use start, build the command line via
SysProcAttr.CmdLine to pass a quoted single argument and an empty title (e.g.,
cmd /c start "" "<uri>") to avoid shell splitting; update the code that sets
variable c and any related error handling in openURI accordingly.