feat(process): support Windows command shims

[chicoxyzzy]

Summary

• add an explicit typed process mode for absolute Windows .cmd and .bat provider launchers
• transport the full NUL-free argument vector as encoded data to a fixed bridge in system Windows PowerShell
• remove all bridge variables before starting the provider, preserving stdin, stdout, stderr, and ordinary exit behavior
• preserve the default direct-execution contract and reject generic shell entrypoints
• cover run, streaming, and started-child paths, including npm-style wrappers, realistic prompts/configuration, and environment privacy

Security boundary

The bridge avoids command-line interpolation and does not expose prompt/config arguments to provider descendants through its environment. It does not authenticate the launcher or establish publisher trust; hosts must enforce signature or fingerprint policy separately.

Verification

• go test ./...
• go vet ./...
• go test -race ./...
• Windows cross-compilation for the full repository
• Windows go vet ./...

Native Windows tests run in CI.

[chicoxyzzy]

Native Windows CI showed that the revised bridge does not preserve stdio, streaming, or exit status for command shims. The earlier implementation also leaked arguments and rejected real provider inputs. Closing this design rather than weakening the process contract; hosts should prefer native executables and handle any narrowly supported launcher form explicitly.