fix: update architecture.md exec.ts docs to match spawn implementation

After the spawn refactor (976b2b2), the docs still described
child_process.execFile/exec with buffered stdout. Updated to reflect
the actual spawn-based implementation with ignored stdout and piped stderr.

Author: fernandomg

architecture.md

@@ -91,10 +91,10 @@ Plain async functions with no UI dependencies. Each operation receives explicit
 
 Two helpers with different security profiles:
 
-- **`execFile(file, args, options)`** — uses `child_process.execFile` (no shell). Arguments are passed as an array, so user input cannot be interpreted as shell metacharacters. Use this whenever user-provided values (e.g., `projectName`) appear in the command.
-- **`exec(command, options)`** — uses `child_process.exec` (spawns a shell). Only for commands that require shell features like `$(...)` substitution. Never interpolate user input into the command string.
+- **`execFile(file, args, options)`** — wraps `child_process.spawn` without a shell. Arguments are passed as an array, so user input cannot be interpreted as shell metacharacters. Use this whenever user-provided values (e.g., `projectName`) appear in the command.
+- **`exec(command, options)`** — wraps `child_process.spawn` to run `/bin/sh -c <command>` (spawns a shell). Only for commands that require shell features like `$(...)` substitution. Never interpolate user input into the command string.
 
-Both helpers capture stdout/stderr (no leaking to parent process) and throw on failure with the stderr message.
+Both helpers use `spawn` with stdout ignored and stderr piped. They do not capture or return stdout — output is not buffered for the caller. They throw on non-zero exit codes with the stderr message.
 
 ## Data Flow