Rename .js to .mjs, extract helpers module

Move resolvePath and exec out of index.mjs into server/helpers.mjs so
actions can import them directly rather than receiving them as arguments.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/helpers.mjs

@@ -0,0 +1,25 @@
+import { spawnSync } from "child_process";
+import path from "path";
+
+const WORKSPACE_ROOT = process.env.CONDUIT_ROOT || "/workspace";
+
+// Resolve a path param relative to WORKSPACE_ROOT, preventing traversal.
+export function resolvePath(userPath) {
+	const resolved = path.resolve(WORKSPACE_ROOT, userPath.replace(/^\//, ""));
+	if (!resolved.startsWith(WORKSPACE_ROOT)) {
+		throw new Error(`Path escapes workspace root: ${userPath}`);
+	}
+	return resolved;
+}
+
+// Execute a binary with an argument list — no shell interpolation.
+export function exec(bin, args = []) {
+	return new Promise((resolve, reject) => {
+		const result = spawnSync(bin, args, { stdio: "inherit" });
+		if (result.error) {
+			reject(result.error);
+		} else {
+			resolve(result.status);
+		}
+	});
+}