Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@dpti/hti.py`:
- Around line 1510-1515: The _graph_link_command function constructs a shell
command by directly interpolating graph_relpath and model_file into an ln -s
command without proper quoting, which creates a security and stability issue if
these paths contain spaces or shell metacharacters. Fix this by using shell
quoting (such as shlex.quote) to properly escape both the graph_relpath source
argument and the model_file destination argument in the return statement, and
add the -f flag to the ln -s command to make it idempotent. Apply the same fix
to the similar code mentioned in the comment at lines 1547-1550.

In `@dpti/mti.py`:
- Around line 339-343: The model_file variable is being interpolated directly
into shell ln -s commands without proper quoting, creating a security and
robustness issue. In the shell command fragments where link_model is assigned
(around lines 339 and 341, and also in the similar block at lines 374-380), wrap
both instances of the model_file variable with double quotes in the ln -s
commands to properly escape shell-sensitive characters. Additionally, add the -f
flag to the ln -s command to make the linking idempotent, so it will overwrite
existing links without error. Apply these same quoting and -f flag changes to
all occurrences of link_model assignments that use model_file.

In `@dpti/ti.py`:
- Around line 1081-1085: The model_file variable is directly interpolated into
the shell command string without proper quoting, creating a vulnerability to
command injection or path parsing issues if the filename contains special
characters or spaces. In the command string that includes the ln -s symlink
creation, wrap both occurrences of model_file with appropriate shell quotes
(single or double quotes) to properly escape the path. This applies to the
conditional command assignment where model_file is used twice in the symlink
command.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@dpti/ti.py`:
- Around line 1081-1084: The command construction at the `ln -sf` statement does
not properly shell-escape the model_file variable before interpolation, which
allows shell injection if the filename contains special characters like quotes.
Use a shell escaping function (such as shlex.quote() in Python) to properly
escape both the symlink source path (the quoted "../{model_file}" part) and the
symlink destination path (the quoted "{model_file}" part) before interpolating
them into the f-string command. This ensures that any special characters in the
filename cannot break out of the quoted context or inject arbitrary commands.