refactor(orphans): use vim.fn.system argv form instead of io.popen

[devin-ai-integration]

Summary

Replaces the io.popen + string.format/shellescape shell pipeline in lua/larpi/utils/orphans.lua with an argv-form vim.fn.system call. This avoids invoking the shell entirely, matches the pattern already used in lua/larpi/lazy.lua, and adds a vim.v.shell_error check so a failing git log no longer gets parsed as a timestamp.

Context: done as a small stylistic/hardening cleanup from a security scan of the repo. The prior code was already safe (it used vim.fn.shellescape on plugin.dir), so this is a readability and defense-in-depth change, not a vulnerability fix.

Review & Testing Checklist for Human

• Run :CheckOrphans in Neovim and confirm the floating window still lists plugins with correct "days ago" values (I could not run Neovim in the sandbox — CI only verifies startup, not this command's runtime behavior).
• Confirm the new vim.v.shell_error == 0 gate is acceptable. This is a minor behavior change: previously any stdout from git log was parsed even if git exited non-zero; now a non-zero exit skips that plugin. In practice git log -1 either succeeds and prints a timestamp or fails and prints nothing to stdout, so behavior should be identical — but worth a conscious sign-off.

Notes

• Formatted with the repo's stylua config (column_width=160, single quotes, 4-space indent).
• CI (.github/workflows/ci.yml) only exercises nvim --headless +qa startup, so it won't exercise check_orphans — green CI is necessary but not sufficient here.

Link to Devin session: https://app.devin.ai/sessions/e5fb96c44f644b0787eb25dfb825d6f1
Requested by: @larpios

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.