Stage Windows primitive; OPE2-00126/00127 protect production

[andrei-hasna]

Why

Windows package-manager shims are batch programs; executing arbitrary batch content would reinterpret user arguments. This PR supplies narrowly recognized native launch-plan groundwork without a generic shell fallback.

This remains staged only: OPE2-00126 and OPE2-00127 must adopt the primitive before production Claude or ACP launches are protected.

Exact accepted scope

• Exact static cmd-shim@9.0.2 Node and direct-executable templates, plus exact legacy cmd-shim@5.0.0/Corepack template spacing only.
• Local node_modules/.bin shims may use one bounded leading .. and must canonicalize beneath that parent node_modules; prefix/global shims must begin node_modules and stay under the shim parent.
• No generic cmd-shim compatibility is claimed: shebang arguments, target environment-variable expansion, malformed grammar, dot/repeated-separator paths, device/verbatim ambiguity, escapes, and reparse escapes fail closed.
• node.exe resolution is source-environment-PATH only. COMSPEC is ignored and no command string or cmd.exe is executed.

Validation

• just test-fast -p codex-external-agent (44 passed)
• just check-fast -p codex-external-agent
• Bazel Windows gnullvm library build: bazel build //codex-rs/external-agent:external-agent --platforms=//:windows_x86_64_gnullvm
• just fix -p codex-external-agent, then just fmt
• Staged and PR-range Gitleaks scans clean

The local host cannot execute the Windows test target because it lacks a Windows execution platform; exact-head Windows CI and two fresh independent parent reviews remain required before merge.