fix: pass cwd to npmRunPathEnv to prevent PATH hijack @W-23797722@

[WillieRuemmele]

Summary

• Pass cwd to npmRunPathEnv() in src/spawn.ts so the child process PATH is built relative to the plugin install directory, not process.cwd()
• Prevents an attacker-controlled node_modules/.bin/node in the repository from being resolved before the trusted Node runtime during JIT plugin installation

Work Item

@W-23797722@: [Bug Bounty / H1] SF CLI - Automatic JIT plugin installation executes repository-local node before the trusted runtime

Test plan

• Clone a repo with a malicious node_modules/.bin/node executable
• Run a JIT command (e.g. sf dev audit messages) and verify the malicious node is NOT executed
• Verify normal JIT plugin installation still works correctly