Resolve npm through the shell for Windows compatibility

The UI license enumeration invoked npm by bare name via subprocess,
which fails on Windows (npm is npm.cmd there — WinError 2 in the
Windows UI-archive packaging step). Resolve it through the shell, which
handles platform shims everywhere; the command is a constant string.

Signed-off-by: Martin Vogel <martin.vogel@datadice.io>

Author: DeusData

scripts/gen-ui-licenses.py

@@ -67,9 +67,11 @@ def declared_license(pkg_dir):
 
 def main():
     ui_dir = sys.argv[1]
+    # shell=True so the npm shim resolves on every platform (npm.cmd on
+    # Windows is not found by bare-name exec). Constant command, no injection.
     ls = subprocess.run(
-        ["npm", "ls", "--omit=dev", "--all", "--json"],
-        cwd=ui_dir, capture_output=True, text=True, check=False,
+        "npm ls --omit=dev --all --json",
+        shell=True, cwd=ui_dir, capture_output=True, text=True, check=False,
     )
     tree = json.loads(ls.stdout or "{}")
     pkgs = set()

scripts/license-gate-check-npm.py

@@ -69,8 +69,10 @@ def main():
     ignored_pkgs = set(policy.get("ignored_npm_packages", []))
     skip_tokens = {"and", "or", "with", ""}
 
-    ls = subprocess.run(["npm", "ls", "--omit=dev", "--all", "--json"],
-                        cwd=ui_dir, capture_output=True, text=True, check=False)
+    # shell=True so the npm shim resolves on every platform (npm.cmd on
+    # Windows is not found by bare-name exec). Constant command, no injection.
+    ls = subprocess.run("npm ls --omit=dev --all --json",
+                        shell=True, cwd=ui_dir, capture_output=True, text=True, check=False)
     tree = json.loads(ls.stdout or "{}")
     pkgs = {}
     collect(ui_dir, tree.get("dependencies"), pkgs)