fix: explicitly quote paths in sys.exec() calls