fix(channel): resolve .exe path from npm .cmd shim on Windows

[wsolarq11]

Fixes #348

spawn("claude") fails on Windows because npm puts only a .cmd shim in PATH, not the real .exe. Node.js >=18.20.2 (CVE-2024-27980) blocks implicit .cmd execution without shell: true. Using shell: true would reintroduce the injection vector -- the args carry --append-system-prompt content.

Instead, parse the npm-generated .cmd shim to find the real .exe, then spawn it directly. No shell, no injection risk.

Change: packages/cli/src/commands/channel/supervisor.ts

• +resolveProviderPath() utility

• 2 lines modified at the spawn call

• 0 import changes, 0 new dependencies

• No effect on macOS/Linux (process.platform guard)

• Fixes both claude and codex adapters

• Falls back to original provider if resolution fails