fix(agent): remove the node PATH shim

[charlesvien]

Problem

Agent process trees get a fake node on PATH that actually runs the desktop app binary via ELECTRON_RUN_AS_NODE. When that env var gets lost along the way (dotfiles, env-scrubbing tools), running node boots a full desktop app instead: the phantom window storms #3239 tried to fix. The wrapper-script fix narrowed the hole but could not close it (stale shims from older installs, dev builds, win32 terminals), and even when the shim works it serves the wrong runtime: Electron's node breaks native addons built for real node and shadows nvm/mise-selected versions.

Both original reasons for the shim are gone: the claude CLI is a native binary now, and fixPath() already puts the user's login-shell PATH (and so their real node) on agent PATHs.

Changes

• Remove the shim entirely. No node alias is written to $TMPDIR/agent-node-*, no PATH prepend into the workspace-server env, and the wrapper/symlink heal and codex PATH-strip logic are deleted. node now resolves through the user's own environment, exactly like their terminal outside the app.
• Delete stale shim dirs from older releases at workspace-server boot (legacy-node-shim.ts), so leftovers on disk can't keep phantom-booting after an update.
• Keep the fix(agent): stop phantom desktop app boots from agent subprocesses #3239 bootstrap guard as a tripwire, and keep the codex local-tools spawn (process.execPath with explicit ELECTRON_RUN_AS_NODE=1), which never depended on the shim.

Machines with no node installed lose the implicit fallback and get a plain "node: command not found". A vendored runtime for zero-setup is tracked in #3114.

Refs #3114.

How did you test this?

• pnpm typecheck green (23 packages).
• New legacy-node-shim.test.ts covers removal of real dirs with file and symlink contents, and the nothing-to-clean case.
• Existing suites green: workspace-server agent, auth-adapter and shell tests (40), codex spawn and local-tools tests (11), full shared package (513).
• Biome clean on all changed files.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit d239500.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "remove the electron node PATH shim" | Re-trigger Greptile}

[stamphog]

Gates denied this PR: it touches authentication adapter code (auth-adapter.ts) and removes dependencies from package.json, both of which are on the deny-list and require human review before automated approval.