fix: address PR review security and validation issues

- Add runtime type check for worktreePath in open-in-terminal handler
- Fix Windows Terminal detection using commandExists before spawn
- Fix xterm shell injection by using sh -c with escapeShellArg
- Use loose equality for null/undefined in useEffectiveDefaultTerminal
- Consolidate duplicate imports from open-in-terminal.js

apps/ui/src/components/views/board-view/worktree-panel/hooks/use-available-terminals.ts

@@ -82,8 +82,8 @@ export function useEffectiveDefaultTerminal(terminals: TerminalInfo[]): Terminal
   const defaultTerminalId = useAppStore((s) => s.defaultTerminalId);
 
   return useMemo(() => {
-    // If user hasn't set a preference (null), they prefer integrated terminal
-    if (defaultTerminalId === null) {
+    // If user hasn't set a preference (null/undefined), they prefer integrated terminal
+    if (defaultTerminalId == null) {
       return null;
     }