babf1d6620
Split EDITOR env var on whitespace so multi-word values like "code --wait" work correctly. Add allow-list switch for sort column and order direction at the query boundary to prevent future callers from passing unsanitized values into SQL.