fix(cli): preserve Windows command arguments

[christso]

Summary

Windows native CLI operations now preserve each argument exactly and no longer emit Node's DEP0190 warning. The shared executor resolves npm .cmd shims to their declared Node interpreter before using shell-free process spawning, so globally installed Claude, Copilot, and Codex CLIs still work without exposing MCP URLs, headers, environment values, plugin names, or other dynamic arguments to cmd.exe parsing.

The resolver follows the configured PATH and PATHEXT order, ignores implicit working-directory entries, prefers an npm shim's sibling node.exe, and rejects nested batch, PowerShell, or unsupported interpreter paths. A Windows-only CI regression runs the bundled helper from Node and Bun parents and covers argument preservation plus these resolution boundaries.

Workspace setup commands are a separate execution domain: they are explicitly user-authored shell programs, launched only by workspace setup as a single shell string. This PR does not route setup commands through the native-client resolver or change their shell syntax and compatibility. The Windows job now exercises the real setup CLI scenarios under cmd.exe as well.

Closes #466

Validation

• bun run build
• bun run typecheck
• bun run lint
• bun test - 1,489 pass, 6 skip, 0 fail across 137 files
• bun run test:e2e - 130 pass, 4 skip, 0 fail across 12 files
• Local focused suites: bun test tests/unit/core/native/types.test.ts tests/unit/cli/workspace-setup-command.test.ts - 10 pass, 1 Windows-only skip, 0 fail
• Windows CI focused suites - 10 pass, 1 intentional POSIX-signal skip, 0 fail; workspace setup contributed 6 pass and native command execution contributed 4 pass
• Built CLI smoke: with an isolated HOME, a PATH-local fake claude, and a proxied MCP server containing https://example.test/mcp?one=1&two=2 plus Authorization=Bearer value & echo injected, ran node "$REPO/dist/index.js" --json update --offline. The CLI exited 0 and delivered the URL and header as unchanged argv elements to claude mcp add.
• Setup-command boundary smoke: a single shell command launched with shell: true and no separate argv completed with setup-ok and no DEP0190 output under --trace-deprecation.
• Built entrypoint smoke: ./dist/index.js --version returned 1.13.6-next.1.

The pre-fix native-client shell-mode probe interpreted SAFE && printf INJECTED as shell syntax and produced SAFEINJECTED; the shell-free native-client path does not.

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	2775dce
Status:	✅  Deploy successful!
Preview URL:	https://79aaeea5.allagents.pages.dev
Branch Preview URL:	https://fix-466-windows-spawn.allagents.pages.dev

View logs