Avoid shell invocation in subset downloader

[resolvicomai]

Summary

• build dataset wget invocations as argument lists instead of shell strings
• build the shared zeroband.utils.wget() invocation as an argument list too
• omit the Authorization header when no Hugging Face token is available
• add focused regression tests for both subprocess invocation paths

Why

The download paths currently joined command strings and used shell=True. Dataset file paths, output paths, and utility inputs can be data-derived, so keeping shell interpretation out of these paths avoids accidental command parsing while preserving the same wget download flow.

Verification

• uv run --no-project --with pytest pytest -q tests/test_subset_data_download.py tests/test_wget_util.py
• python3 -m py_compile src/zeroband/utils/wget.py tests/test_subset_data_download.py tests/test_wget_util.py
• git diff --check