Windows: dev pool fails to boot — spawn npm ENOENT / npm.cmd EINVAL (Node 24.18)

[Imnasir-X]

Summary

On Windows (Node 24.18.0), the local dev pool cannot install/build plugins:
scripts/dev/deps.ts calls run("npm", ["install"], ...) and run("npm", ["run","build"], ...)
through scripts/dev/lib/proc.ts. On Windows, npm resolves to npm.cmd, and Node's
child_process.spawn cannot execute it directly:

• spawn("npm", ...) -> ENOENT (bare npm is not an executable on Windows)
• spawn("npm.cmd", ...) -> EINVAL on Node 24.18.0 (regression: .cmd files can no longer be spawned directly without a shell; Node 24.18 also rejects the shell:true-less .cmd spawn with EINVAL)

Empirical matrix (Node v24.18.0, win-x64):

call	result
spawn("npm")	ENOENT
spawn("npm.cmd")	EINVAL
spawn("cmd.exe", ["/d","/s","/c","npm.cmd", ...])	works (npm 11.16.0, exit 0)
spawn(cmd, args, {shell:true})	works (deprecated)

Observed failure during node scripts/dev/cli.ts up --no-slack:

deps: fail -- npm install failed in .../plugins/web-ui: spawn npm ENOENT

Suggested fix (minimal, local)

In scripts/dev/lib/proc.ts, resolve the command against PATH on win32
(npm -> npm.cmd, tsx -> tsx.cmd, etc.) and spawn .cmd/.bat via
cmd.exe /d /s /c <resolved> <args...>; leave .exe/.com and non-Windows
behavior unchanged. This keeps a single spawn choke point and fixes both
deps.ts npm calls and any other bare-command child spawns on Windows.

Verified locally with this change: pool boot completes (deps: ok, children
core/web/admin/portal all ok) on Windows with Node 24.18.0.

Environment

• OS: Windows 10/11 (NT 10.0.26200)
• Node: v24.18.0 (official win-x64 build); npm 11.16.0
• QM pin: b702813

[yzxcj797]

Working on this with the choke-point approach — two subtleties surfaced while verifying on Windows (Node 24.14) that are worth encoding in the fix:

1. PATH resolution order matters beyond the obvious: Node's install dir ships an extensionless npm sh-script (for bash environments) next to npm.cmd. Trying the extensionless name before PATHEXT hands spawn a non-executable file — PATHEXT extensions must be tried first, extensionless last (matching cmd.exe semantics).
2. Quoting: cmd.exe re-parses everything after /c, and Node escapes embedded quotes with backslashes that cmd cannot parse. The shim path usually contains a space (C:\Program Files odejs pm.cmd), so the fix builds one pre-quoted command line ("C:\... pm.cmd" --version), wraps it in an outer quote pair that /s strips, and passes it verbatim (windowsVerbatimArguments).

Verified on Windows: run("npm", ["--version"]) returns exit 0 with the version printed; spawnDetached runs a node child through the same choke point; the discriminating tests fail before the change and pass after. PR incoming with tests (Windows-gated where the bug is Windows-only, passthrough assertions elsewhere).