docx 安全评估 v3

The pack.py and redlining.py scripts use subprocess.run() to execute external commands (soffice, git). These are legitimate document processing tools, but subprocess execution is a potential risk factor. Evidence from pack.py:103-116: ```python result = subprocess.run([ "soffice", "--headless", "--convert-to", filter_name, "--outdir", temp_dir, str(doc_path), ], capture_output=True, timeout=10, text=True) ``` Evidence from redlining.py:153-163: ```python result = subprocess.run([ "git", "diff", "--word-diff=plain", "--word-diff-regex=.", "-U0", "--no-index", str(original_file), str(modified_file), ], capture_output=True, text=True) ```

The document.py library creates temporary directories and writes modified documents back to user-specified locations. This is expected behavior for a document editing tool. Evidence from document.py:640-646: ```python self.temp_dir = tempfile.mkdtemp(prefix="docx_") self.unpacked_path = Path(self.temp_dir) / "unpacked" shutil.copytree(self.original_path, self.unpacked_path) self.original_docx = Path(self.temp_dir) / "original.docx" pack_document(self.original_path, self.original_docx, validate=False) ```