fix(cli): resolve Windows npx shims for skills

[miguel-heygen]

Summary

• add a shared CLI helper for trusted npx invocations
• use cmd.exe /d /s /c npx.cmd ... on Windows, while Linux and macOS keep direct npx ...
• route both hyperframes skills and the sibling hyperframes preview npx vite spawn through the helper
• add platform-specific unit coverage plus a host smoke test, and run it on Ubuntu, macOS, and Windows in CI

Root cause

Windows npm exposes npx as an npx.cmd shim. The CLI used bare npx through child_process.execFileSync and spawn, so Node could fail to resolve/execute the shim even though npx --version worked in the user's shell. The fix invokes the Windows shim through cmd.exe explicitly instead of relying on PATHEXT lookup or shell: true.

Fixes #1625.

Test plan

• bunx oxfmt --check .github/workflows/ci.yml packages/cli/src/commands/skills.ts packages/cli/src/commands/skills.test.ts packages/cli/src/commands/preview.ts packages/cli/src/utils/npxCommand.ts packages/cli/src/utils/npxCommand.test.ts
• bunx oxlint packages/cli/src/commands/skills.ts packages/cli/src/commands/skills.test.ts packages/cli/src/commands/preview.ts packages/cli/src/utils/npxCommand.ts packages/cli/src/utils/npxCommand.test.ts
• bun run --cwd packages/cli typecheck
• bun run --cwd packages/cli build
• volta run --node 22.20.0 bun run --cwd packages/cli test src/commands/skills.test.ts src/utils/npxCommand.test.ts
• volta run --node 22.20.0 bun run --cwd packages/cli test