fix(libnpmexec): escape inferred executable names for selected shell

[martinrrm]

Summary

Draft proposal for the Windows side of CLI-170 (#15347).

When npx <package> infers an executable from package bin metadata, the executable name becomes part of a synthetic npm script. On Windows, that script is ultimately interpreted by cmd.exe. This change protects the inferred executable token according to the selected shell instead of forwarding it unquoted.

Supporting dependency PR: npm/promise-spawn#166

Changes

lib/run-script.js

• Escape the executable token when no explicit call script was supplied.
• Select the escaping strategy from scriptShell, including POSIX shells selected on Windows.
• For cmd.exe, protect command separators, spaces, command keywords, and other cmd metacharacters.
• Reject executable names containing double quotes, percent signs, exclamation marks, or control characters that cannot be safely represented as a cmd executable token.
• Preserve call as an intentionally supplied shell script; its arguments are not treated as inferred executable names.

lib/index.js

• On a matching npx-cache hit, select the inferred command from the installed package manifest rather than mutable registry metadata.

This cache-manifest adjustment is related hardening and may be split into a separate change during review if preferred.

Tests and documentation

• Add unit coverage for cmd.exe token encoding and rejection cases.
• Add coverage for POSIX escaping when a POSIX shell is selected on Windows.
• Add normalized-bin registry regressions covering command separators and cache metadata mismatches.
• Document the shell-specific executable handling and rejected cmd.exe characters.

Dependency requirement

The npm CLI change depends on the promise-spawn fix in npm/promise-spawn#166. That change allows promise-spawn to recognize an executable token that has already been quoted and caret-escaped, preserving .cmd/.bat double escaping for arguments.

The dependency should be consumed through released @npmcli/promise-spawn and @npmcli/run-script versions before merging this PR. The tracked bundled promise-spawn copy is included here to show the integrated behavior and should be regenerated from the released dependency during final dependency updates.

Validation

• Changed JavaScript files pass syntax checks.
• git diff --check passes.
• Promise-spawn targeted shell tests and lint pass in the supporting PR.
• No vulnerability reproduction or malicious command execution was run.

Review status

This is intentionally a draft while the promise-spawn dependency change and release sequence are reviewed.