fix(skills): bootstrap npm safely on Windows

[miguel-heygen]

What

HyperFrames skill helpers can now bootstrap missing npm packages on Windows and Node 24 without failing at the spawnSync("npm.cmd") boundary.

Why

Direct .cmd spawning without a shell is rejected on the reported Windows/Node 24 path. Enabling a shell would weaken the bootstrap's argv and lifecycle-script safety guarantees, so Windows now invokes npm's JavaScript CLI through Node instead.

The earlier closed change did not update the published skill manifest or exercise the resolved command on a real Windows/Node 24 runner. This version includes both gates.

Related: #2321

How

• Resolve npm_execpath first, then the npm-cli.js installed beside Node.
• Invoke that file through npm_node_execpath or process.execPath with an argv array and no shell.
• Preserve the existing non-Windows npm command and temporary --ignore-scripts install contract.
• Keep the animation and creative skill loaders byte-identical.
• Run the exact loader tests on windows-latest with Node 24; the Windows-only test launches the resolved npm CLI.

Test plan

• Package-loader tests: 10 passed and 2 Windows-only cases skipped on Linux.
• Skill manifest regenerated and verified in sync.
• Skill lint and project-skill mirror checks passed.
• Changed-file formatting and lint passed.
• Workflow syntax passed actionlint after excluding three existing unrelated SC2034 warnings.
• Full skill suite: 589 passed and 2 skipped; the unrelated skills/media-use/scripts/resolve.test.mjs suite timed out.
• Windows Node 24 smoke runs in PR CI.
• Documentation updated (not applicable).

[miga-heygen]

Clean fix for the Windows npm.cmd shell injection vector — direct node+npm-cli.js invocation with proper path resolution and CI gate. — Miga