Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tools/cli/examples.js`:
- Around line 7-9: EXAMPLES_BRANCH is pinned to a mutable feature branch causing
runtime breakage; change the reference so EXAMPLES_JSON_URL points to an
immutable ref (canonical branch like "main" or, better, a specific tag or commit
SHA). Replace the EXAMPLES_BRANCH value (and any usage in EXAMPLES_JSON_URL)
with the chosen stable identifier (e.g. a tag name or commit hash) so the CLI
fetches a permanent URL instead of the mutable "migrate-examples" branch.
- Around line 72-97: getExamples currently ignores the refresh flag and always
falls back to cache on network failure; update getExamples({ refresh = false })
so that when refresh is true it does not return cached.examples on fetch failure
but instead re-throws the fetch error (i.e., bypass the cached return path), and
ensure any consumer recovery hints (e.g., in tools/cli/commands.js) do not
reference a non-existent --refresh flag — either remove that hint or update it
to the correct command/flag. Locate symbols getExamples, fetchExamplesJson,
writeCache, readCache and EXAMPLES_BRANCH to make the change and adjust the
user-facing recovery hint accordingly.
- Around line 165-172: The code builds subdirPath with files.pathJoin(tempDir,
subdir) then blindly copies with files.cp_r, allowing `..` to escape the temp
clone; resolve the candidate path (e.g., use files.realpath or path.resolve on
the joined path and on tempDir) and verify the resolved subdirPath is contained
inside the resolved tempDir (use path.relative or string-prefix check with a
trailing separator) before proceeding; if the resolved path is outside tempDir
throw an error (replace or precede the existing files.exists check), and only
then call files.cp_r.
- Around line 104-121: The cloneRepo and cloneSubdirectory functions use exec()
with interpolated strings (url, branch, repoUrl, destPath) creating
command-injection risks and breaking paths with spaces; replace exec() calls
with child_process.spawn() or execFile() using argv arrays and shell: false,
pass the git command and its arguments as separate array elements (e.g.,
['clone','--progress', '--branch', branch, url, dest]) and supply { env:
process.env }/stdio handling and proper error/exit handling; ensure
process.env.GIT_TERMINAL_PROMPT is set the same and that you handle Windows
quoting by passing raw paths (converted with files.convertToOSPath) as separate
argv entries instead of embedding them in a shell string.

In `@tools/e2e-tests/example.test.js`:
- Around line 14-60: The tests in example.test.js (the "meteor create
--example", "--from", and "--from with --from-branch and --from-dir" cases)
depend on live GitHub repos and should be made deterministic: replace external
network calls by creating local fixture git repositories (using tempApp /
tempDir) or by mocking the code path that fetches remote examples used by
runMeteorCommand, then point the tests to those local repo URLs (or stubbed
responses) and remove reliance on real branches/repos; ensure cleanupTempDir is
still used to remove fixtures and keep the existing assertions
(fs.existsSync(path.join(tempDir, '.meteor'))) unchanged.

---

Outside diff comments:
In `@tools/cli/commands.js`:
- Around line 935-980: setup() is prompting for a skeleton even for
clone/example flows; update setup() to detect options.example || options.from
before showing interactive prompts and immediately return { appPathAsEntered,
skeleton } so clone/from flows don't get the skeleton prompt—use the
already-computed skeletonExplicitOption or DEFAULT_SKELETON as the returned
skeleton (and preserve any explicit skeleton flag), and only run the inquirer
flow when neither options.example nor options.from apply (this change also
covers the related prompt logic referenced around the subsequent skeleton
handling).

---

Nitpick comments:
In `@tools/e2e-tests/example.test.js`:
- Around line 66-92: Update the two negative assertions to verify specific error
messages instead of a generic rejects.toThrow(); for the first test (the one
using tempApp('baddir')), change the expectation on runMeteorCommand(...) to
assert the rejection message/pattern contains the “directory not found” text (or
the exact error text your CLI/git layer emits when --from-dir is missing) and
for the second test (tempApp('nonmeteor')) assert the rejection message/pattern
contains the “not a Meteor app” (or repo validation) text; locate the calls to
runMeteorCommand in these two it blocks and replace rejects.toThrow() with
rejects.toThrow(/expected-regex-or-string/) (or the test framework equivalent)
so failures like network/git outages won’t falsely satisfy the test.