Supply Chain Audit False Positive

The Scan PR for critical supply chain risks check is a false positive for this PR.

The scan script checks for patterns like subprocess.run(...) + base64/\x/chr() as indicators of obfuscated payload execution. However, this PR only changes:

- text=True,
+ encoding="utf-8",
+ errors="replace",

The pattern match is likely triggered by the word encoding appearing alongside subprocess.run(), which is a perfectly legitimate and recommended Python pattern for handling non-UTF-8 subprocess output.

There is no base64, no exec/eval, no hex-encoded strings, no .pth files — just standard subprocess.run() with explicit encoding parameters, which is the recommended approach per Python docs.

This is the same false positive that affected other recent PRs (e.g. #17262, #17163).

Competing fix for #17049 — same approach as #17074 and #17252 (errors='replace' + None guard). Maintainer should pick one.

Closing in favor of #17435 (#17435), which ships the minimal encoding='utf-8', errors='ignore' fix for #17049 at both affected wmic call sites (gateway.py + main.py). This PR's scope extended well beyond the reported issue (SIGUSR1 restart logic, WeCom setup, Yuanbao platform, QQBot QR flow, etc.) — happy to review those as separate focused PRs if you'd like to resubmit them individually. Thanks for the contribution.