fix(windows): set windowsHide on remaining child spawns to stop console flash (#1092) (#1104)

On Windows, a black console (conhost) window flashed briefly when CodeGraph
ran as a background MCP server. Several child spawns were missing
`windowsHide: true`, so Windows created a visible console for the child:

- scripts/npm-shim.js — launching the bundled runtime (every server start /
  daemon-idle reconnect) and the self-heal `tar` extraction of a missing
  platform bundle.
- src/reasoning/login.ts — the detached `cmd /c start` browser open.
- src/upgrade/index.ts — package-manager spawn (console-attached, so no flash
  in practice, but set for uniformity: every child spawn now hides).

The daemon spawn (#411) and all git execFileSync sites already set it; this
closes the remaining gaps. Adds an all-platforms source guard to
__tests__/npm-shim.test.ts asserting every spawn in the shim sets windowsHide.

Closes #1092

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/npm-shim.js

@@ -45,7 +45,7 @@ async function main() {
   // Happy path: the npm-installed optional dependency. Fall back to a download
   // when the registry didn't deliver it.
   var resolved = resolveInstalledBundle() || (await selfHealBundle());
-  var res = childProcess.spawnSync(resolved.command, resolved.args, { stdio: 'inherit' });
+  var res = childProcess.spawnSync(resolved.command, resolved.args, { stdio: 'inherit', windowsHide: true });
   if (res.error) {
     process.stderr.write('codegraph: ' + res.error.message + '\n');
     process.exit(1);
@@ -222,7 +222,7 @@ function extract(archive, destDir) {
   var args = isWindows
     ? ['-xf', archive, '-C', destDir, '--strip-components=1']
     : ['-xzf', archive, '-C', destDir, '--strip-components=1'];
-  var res = childProcess.spawnSync('tar', args, { stdio: 'ignore' });
+  var res = childProcess.spawnSync('tar', args, { stdio: 'ignore', windowsHide: true });
   if (res.error) throw new Error('tar unavailable: ' + res.error.message);
   if (res.status !== 0) throw new Error('tar exited ' + res.status);
 }