…o true

- Add WINDOWS_CMD_SHIMS allowlist + shouldUseShellForCommand helper so
  pnpm/npm/npx hit a shell on win32 (Node post-CVE-2024-27980 rejects
  direct .cmd/.bat spawn) while native exes like git keep shell:false.
- Apply the helper to packages/server provider runtime, scripts/shared
  process utilities, and publish-cli; drop the dead resolveSpawnCommand
  passthrough.
- Default windowsHide to true everywhere so background child processes
  don't flash a console window.
- Fix CI Windows runtime lane referencing the renamed test file.
- Cover the new behavior with unit tests.

…r-studio/utils

The server package and root build scripts previously kept identical copies of
isDirectExecution (with its path-normalizing helpers) and the
WINDOWS_CMD_SHIMS / shouldUseShellForCommand pair. Both areas care about the
same Windows / ESM entry-point gotchas, so any fix needed to be made twice and
risked drifting.

- Add packages/utils workspace package mirroring the @coder-studio/core layout.
- Move helpers into utils with co-located vitest coverage.
- packages/server now depends on @coder-studio/utils; server.ts and
  provider-runtime/command-runner.ts import from it and the duplicate
  direct-execution.ts is removed.
- scripts/shared/process.ts re-exports the helpers from utils (call sites
  unchanged) and the obsolete process.test.ts is dropped in favor of the new
  utils tests.
- Wire @coder-studio/utils into the root devDependencies, ci:typecheck, the
  esbuild alias map, and scripts/shared/paths so the CLI bundle resolves it
  correctly.

node-pty calls Win32 CreateProcess directly, which only auto-appends
.exe and cannot run .cmd/.bat shims. Tools installed by npm (codex,
aider, ...) ship as cmd-shims that wrap a `node <entry.js>` invocation,
so launching them through the terminal failed with "Cannot create
process, error code: 2".

Add a windows-only resolver that walks PATH+PATHEXT and parses the
two standard npm cmd-shim templates into their underlying node argv.
Plug it into NodePtyHost.spawn so the existing terminal flow recovers
the same semantics POSIX gets via shebang. Linux/macOS short-circuit
back to the original argv. Native .exe installs (claude, future
provider binaries) just resolve to an absolute path and pass through.

…into develop