Harden the RBA harness subscription-client spawn (drop shell:true — Node DEP0190)

The first live FirecrawlConnector RBA run (First live FirecrawlConnector run against a real client source — field evidence for the reserved web seam) surfaced a minor hardening item: the harness clients/rba/harness/subscription-client.mjs spawns claude with shell: true, which triggers Node's DEP0190 deprecation warning (passing arguments alongside shell: true is deprecated). Replace it with a direct spawn(cmd, args) (no shell) — quieter and safer (no shell-quoting / injection surface).

Scope note

The harness lives under clients/, which is gitignored (a local sandbox, not committed to the Dossier repo — Fix git-per-tenant isolation when a tenant root is nested inside another repo). So this is sandbox-harness hygiene, not shipped-product code: low severity, easy fix, filed so it is durable rather than lost in a reply. Filed by the log-auditor from the run; confidence: inferred.