MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper (CVE-2026-47708) | HOL Guard CVE