fix(scripts): find the manifest without exports, quote shell args on Windows

Copilot review round 2 (suppressed comments), all three real:

- `require.resolve("<pkg>/package.json")` is governed by the package's
  `exports`, and Node keeps no special case for `./package.json` — so a
  package declaring an `exports` map without it threw
  ERR_PACKAGE_PATH_NOT_EXPORTED even though its bin was installed and
  spawnable, a false "not installed" pointing at `npm install` for a
  package already on disk. Walk `resolve.paths()` instead, which never
  consults `exports`. The docblock claiming the opposite is corrected.
- `shell: true` (needed at all on Windows to start the `.cmd` shims) makes
  Node hand `cmd.exe` one space-joined string, so an argument holding a
  path with a space splits in two. Every generated path in
  pack-and-verify lives under `tmpdir()`, which sits beneath the user
  profile. Quote them via `shellArgs()` at all four spawn sites, the
  command path included — the hazard predates this PR, so fix the class.
- Document the new module: `scripts/lib/resolve-node-bin.mjs` in AGENTS.md's
  scripts/ tree, its tests in the README's `test:scripts` row.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01387r3MotGk52hrkfjzHFsN
Signed-off-by: cliffhall <cliff@futurescale.com>

AGENTS.md

@@ -128,7 +128,12 @@ v2/main/
 │                                       #   pack-and-verify.mjs, and lib/ shared helpers
 │                                       #   (tsc-program.mjs is the `tsc --listFilesOnly`
 │                                       #   measurement both coverage guards read a program
-│                                       #   through — #1965). Prettier-gated via
+│                                       #   through — #1965; resolve-node-bin.mjs resolves a
+│                                       #   package's bin through its own package.json so the
+│                                       #   verify/smoke/pack scripts spawn it with
+│                                       #   `process.execPath` instead of the `npx`/`npm`
+│                                       #   `.cmd` shims Node refuses to spawn shell-free on
+│                                       #   Windows — #1939). Prettier-gated via
 │                                       #   `format:check:scripts`; its own pure parsers are
 │                                       #   unit-tested by `npm run test:scripts` (node --test).
 ├── specification/                      # Build specification