fix(health): bootstrap Git for Windows runtime in PowerShell

[feizaodemon]

Problem

On Windows, a normal PowerShell or Codex process can find Git while Git for Windows' Unix runtime directories are absent from PATH. Health's update and collection commands then resolve the Windows WSL launcher or fail on tools such as sed, forcing users to prepend Git runtime paths manually.

Root cause

Health invoked Bash without first resolving the actual Git for Windows installation and constructing an isolated child environment.

Fix

• resolve Git for Windows from the discovered git.exe or bash.exe;
• prepend usr/bin, mingw64/bin, bin, and cmd only for the Health Bash child;
• pass a discovered native Python executable to Health-owned shell wrappers;
• keep the parent, user, and system environment unchanged;
• keep the optional update check silent and non-blocking;
• retain the direct Bash path on non-Windows platforms.

Verification

• Pristine c1a0d6e: sed was unavailable, bash resolved to the Windows WSL launcher, and both update and collect exited 1 with WSL diagnostic noise.
• Patched clean-PATH collector: exit 0, empty stderr, no sed/not found noise.
• Focused Windows tests: 5 passed, including a path-with-spaces installation, offline update check, collector startup, parent-PATH preservation, and one actionable missing-runtime diagnostic.
• Full Python layer: 85 passed; one Windows CRLF assertion failed identically on pristine upstream (80 passed, same single failure).
• verify_skills.py, generated-mirror verification, routing verification, shell syntax, Python compilation, packaging, and post-package validation passed.
• Parent PATH and target Git status were unchanged before and after the runtime smoke.
• GitHub Actions provides the Linux/non-Windows validation for this branch.

Known baseline limitation

tests/python/test_build_metadata.py::test_collect_skill_shared_assets_copies_durable_context_when_linked expects LF bytes but receives CRLF on Windows. It fails identically on pristine upstream and this branch; this PR does not change that test.

Out of scope

• project-verifier execution policy;
• a general shell/runtime redesign;
• CRLF cleanup;
• unrelated Health behavior.