fix(auth-server): run bulk-mailer test scripts without a shell

[vbudhram]

Because

• CodeQL flagged four execAsync calls in bulk-mailer.in.spec.ts. Each one builds a shell command from a __dirname-derived path.
• A path with characters the shell treats specially can change what the command does.

This pull request

• Replaces promisify(cp.exec) with promisify(cp.execFile) and adds a runScript(args) helper. The script and its options go through as an argument array, so no value reaches a shell.
• Captures the dump-users output from stdout and writes user_dump.json with fs. execFile has no shell, so the old > redirect is gone. The dump is parsed before it is written, so a short read fails in beforeAll instead of confusing a later test.
• Raises maxBuffer to 10 MB, because script output now comes back through a pipe instead of going straight to disk.
• Passes the real USER_DUMP_PATH in the two --method tests. They used single quotes, so the script got the literal text ${USER_DUMP_PATH} as its input path. Both still fail for the reason their names give.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-13670

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: packages/fxa-auth-server/test/scripts/bulk-mailer.in.spec.ts.
• Suggested review order: the runScript helper, then beforeAll, then the six call sites.
• Risky or complex parts: the beforeAll dump. It is the only site that lost a shell redirect. Check that user_dump.json still lands before the tests that read it.

Screenshots (Optional)

None. There is no user interface change.

Other information (Optional)

• I did not run this spec. It creates real accounts, so it needs MySQL and Redis. CI covers it: the scripts Jest project matches test/scripts/**/*.in.spec.ts, and CircleCI runs the test-scripts target.
• The type-check is clean for the changed file, and npx nx lint fxa-auth-server exits 0.
• The fxa-auth-server unit suite reports 3758 passed and 13 failed. The same 13 fail on a pristine tree, in lib/routes/account.spec.ts and config/index.spec.ts. The unit Jest project ignores *.in.spec.ts, so it never loads the changed file.
• Every assertion in the spec is unchanged. No test was added, removed, or re-enabled.

[Copilot]

Pull request overview

Replaces shell-based bulk-mailer test execution with argument-safe execFile calls.

Changes:

• Adds a shared shell-free script runner.
• Captures, validates, and writes the user dump explicitly.
• Corrects test arguments to use the actual dump path.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.