Harden remote kubectl argument quoting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de

scripts/audit-core-whitehat-e2-credentials-02.py

@@ -7,6 +7,7 @@ import argparse
 import json
 import os
 import secrets
+import shlex
 import stat
 import subprocess
 import sys
@@ -109,7 +110,7 @@ class Operator:
 
     def kubectl(self, args: list[str], *, label: str, input_text: str | None = None, allow_missing: bool = False) -> subprocess.CompletedProcess[str]:
         return safe_run(
-            ["ssh", "-o", "BatchMode=yes", self.remote, "kubectl", *args],
+            ["ssh", "-o", "BatchMode=yes", self.remote, shlex.join(["kubectl", *args])],
             label=label,
             input_text=input_text,
             allow_missing=allow_missing,