fix(windows): set windowsHide on remaining child spawns to stop console flash (#1092) (#1104)

On Windows, a black console (conhost) window flashed briefly when CodeGraph
ran as a background MCP server. Several child spawns were missing
`windowsHide: true`, so Windows created a visible console for the child:

- scripts/npm-shim.js — launching the bundled runtime (every server start /
  daemon-idle reconnect) and the self-heal `tar` extraction of a missing
  platform bundle.
- src/reasoning/login.ts — the detached `cmd /c start` browser open.
- src/upgrade/index.ts — package-manager spawn (console-attached, so no flash
  in practice, but set for uniformity: every child spawn now hides).

The daemon spawn (#411) and all git execFileSync sites already set it; this
closes the remaining gaps. Adds an all-platforms source guard to
__tests__/npm-shim.test.ts asserting every spawn in the shim sets windowsHide.

Closes #1092

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/upgrade/index.ts

@@ -546,7 +546,7 @@ export function hasCommand(cmd: string): boolean {
 }
 
 export function defaultRun(cmd: string, args: string[], env?: NodeJS.ProcessEnv): number {
-  const r = spawnSync(cmd, args, { stdio: 'inherit', env: env ?? process.env });
+  const r = spawnSync(cmd, args, { stdio: 'inherit', env: env ?? process.env, windowsHide: true });
   if (r.error) return -1;
   return r.status ?? -1;
 }