child_process: validate exec's options.shell as string

[Renegade334]

exec() is documented to only take a string for the shell option, but this is not validated; passing something like { shell: false } (or any other invalid value) is currently silently ignored. This adds explicit validation.

Replaces #58525.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.03%. Comparing base (6bb08f7) to head (a355ebf).
Report is 10 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #59185      +/-   ##
==========================================
- Coverage   90.04%   90.03%   -0.01%     
==========================================
  Files         648      648              
  Lines      190978   191031      +53     
  Branches    37434    37451      +17     
==========================================
+ Hits       171964   171994      +30     
- Misses      11641    11650       +9     
- Partials     7373     7387      +14     

Files with missing lines	Coverage Δ
lib/child_process.js	95.57% <100.00%> (+0.02%)	⬆️

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/68165/

[himself65]

shell: true is a widely used input. many downstream devs (and me) are actually using it.

https://github.com/search?q=child_process+shell%3A+true+language%3AJavaScript&type=code&l=JavaScript

So this is a breaking change. I personally unvote this

[Renegade334]

On exec() or its sister functions?

This is only adding validation of documented behaviour, which by precedent is not a breaking change – not that it's for me to say.

[himself65]

yeah, it is string on document. But I think it's too loose before on runtime, now it's hard to make it back