fix: git init command injection in boxes CLI

[maradini77]

replace shell-based git init call with spawnSync to prevent command injection via project name; surface an explicit error when repository initialization fails