fix: resolve node bins via package.json instead of spawning npx .cmd shims so the verify/smoke scripts run on Windows

On Windows npx/npm are .cmd shims a shell-free execFileSync/spawnSync
cannot start (ENOENT since the CVE-2024-27980 hardening), so
verify:typecheck-coverage died at validate's second step — doubly
silently, echoing "(no diagnostic captured)" per project and then
reporting all 918 tracked files as getting no tsc pass — and
verify:build-gate, the smoke test-server bootstraps, and pack:verify's
npm pack failed the same way.

Add scripts/lib/resolve-node-bin.mjs: resolves the JS entry behind a
package's bin from <pkg>/package.json (deep resolution is blocked by
Vite 8's exports map) and spawns it via process.execPath — the same
walk npx --no-install did, cross-platform and shell-free. Switch the
six npx call sites to it; the npm pack call gets the existing
shell-on-win32 idiom instead (npm has no in-tree package to resolve).
An unresolvable tsc is now a hard "cannot measure" error with
actionable stderr, pinned by a new main() regression test.

Closes #1939

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/pack-and-verify.mjs

@@ -137,7 +137,9 @@ step("packing the publishable tarball (npm pack)...");
 const pack = spawnSync(
   "npm",
   ["pack", "--json", "--ignore-scripts", "--pack-destination", tmpdir()],
-  { cwd: repoRoot, encoding: "utf8" },
+  // npm is npm.cmd on Windows, which needs a shell to resolve (#1939) — the
+  // same idiom as runInherit/runBin below.
+  { cwd: repoRoot, encoding: "utf8", shell: process.platform === "win32" },
 );
 if (pack.status !== 0) {
   fail(`\`npm pack\` failed:\n${pack.stderr || pack.stdout}`);