fix(FN-XXXX): narrow backup matcher and isolate version probes

Two follow-up corrections to the in-process auto-backup interception:

- The matcher previously hijacked any `fn backup …` / `fusion backup …` /
  `runfusion.ai backup …` form. The in-process replacement only knows how
  to do `--create` + cleanup, so scheduling `--list`, `--cleanup`, or
  `--restore <file>` would have silently executed a create instead of the
  requested operation. The matcher is now anchored to `backup --create`
  (with optional trailing flags), with positive/negative unit tests.
- Step-based automations (`AutomationStep` with `type: "command"`) also
  shell out — the legacy-command interception alone left that path
  vulnerable. `executeCommandStep` now applies the same in-process backup
  detour, factored through a shared `runBackupActionInProcess` helper.

Independently, `runProbe` in fn-binary now spawns with `cwd: tmpdir()`.
The dashboard's `/system/fn-binary/status` route runs `<bin> --version`
on whatever fusion binary happens to be on PATH — older releases (e.g.
v0.13.0) initialise an engine and create a fresh `.fusion/<project>/
.fusion/` tree as a side effect. Pinning the probe's cwd to the OS temp
directory keeps any such artefacts off the developer's project.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/core/src/fn-binary.ts

@@ -13,7 +13,7 @@
  */
 
 import { spawn } from "node:child_process";
-import { platform } from "node:os";
+import { platform, tmpdir } from "node:os";
 
 interface ProbeResult {
   exitCode: number | null;
@@ -31,7 +31,15 @@ function runProbe(command: string, args: string[], timeoutMs: number): Promise<P
   return new Promise((resolve) => {
     let stdout = "";
     let stderr = "";
-    const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"], shell: false });
+    // Run probes from the OS temp directory so a buggy CLI version (older
+    // `runfusion.ai` releases initialise an engine — and a fresh
+    // `.fusion/<project>/.fusion/` tree — even on `--version`) cannot leave
+    // artefacts under whichever project happens to be the parent's cwd.
+    const child = spawn(command, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      shell: false,
+      cwd: tmpdir(),
+    });
     const timer = setTimeout(() => {
       try { child.kill("SIGKILL"); } catch { /* ignore */ }
     }, timeoutMs);