Add CI smoke test for CLI launch + --dry-run flag + fix isOnPath isolation

[Copilot]

v0.6.0 shipped a broken CLI (shell: true in spawn() split the bootstrap prompt into multiple args) with no CI coverage of the launch path. This adds that coverage and the infrastructure to keep it green.

Core fixes

• isOnPath() rewrite — replaced execFileSync("which", ...) with direct fs.accessSync() iteration over PATH entries. Eliminates the dependency on which/where being on PATH (broke test isolation), uses F_OK on Windows where X_OK is meaningless.
• Pre-existing test failures fixed — TC-CLI-070/TC-CLI-072 were silently broken because runDetectCli() set PATH=mockDir only, leaving which unreachable. Now works correctly since isOnPath needs no shell utilities.

New: --dry-run flag

$ promptkit interactive --cli copilot --dry-run
[DRY RUN] Would spawn:
  cmd:  copilot
  args: ["--add-dir","/tmp/promptkit-xxx","-i","Read and execute /tmp/promptkit-xxx/bootstrap.md"]
  cwd:  /home/user/project

Prints the exact spawn invocation and exits 0 — no LLM CLI required. Used directly in CI smoke steps.

New tests

TC	What it catches
TC-CLI-084	shell: true absent from non-comment lines in launch.js — direct regression guard for v0.6.0 bug
TC-CLI-085	--dry-run exits 0, args JSON parses to a single bootstrap.md element (verifies no shell-splitting), path is absolute

CI workflow

• Added cli/** to path triggers on both push and pull_request.
• Added permissions: contents: read at workflow level.
• New cli-smoke-test job: npm ci && npm test + explicit --dry-run invocations for copilot and claude.

[Copilot]

Pull request overview

This PR adds CI coverage for the CLI launch path and introduces a --dry-run mode to validate spawn invocation formatting without requiring a real LLM CLI, while also improving PATH detection isolation by removing reliance on which/where.

Changes:

• Reworked CLI PATH detection to scan PATH directories directly (no external which/where dependency).
• Added --dry-run flag to print the exact spawn command/args and exit without launching.
• Added regression tests + a GitHub Actions smoke-test job to keep the CLI launch path covered in CI.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.

File	Description
cli/lib/launch.js	Implements PATH scanning for CLI detection and adds dryRun option to launchInteractive().
cli/bin/cli.js	Exposes --dry-run option and passes it into launchInteractive().
cli/tests/launch.test.js	Adds regression tests for shell: true absence and validates --dry-run output/args structure.
.github/workflows/validate-manifest.yml	Triggers workflow on cli/** changes and adds a CLI smoke-test job (Node 20).