Remove shell expansion for git commands

[bryane-oai]

Summary

Ensure Git commands are executed directly on Windows instead of being routed through a shell.

Git reference names can contain characters that Windows shells interpret specially. Passing those references through shell: true can therefore change the meaning of an otherwise valid Git command. This change keeps Git arguments as a literal argv array by forcing shell: false in the shared Git helpers.

Historical context

Windows npm installations expose tools such as npm and codex through .cmd shims, which Node cannot launch directly in some configurations.

• #13 enabled shell: true for the shared synchronous command runner so Windows could resolve those shims.
• #55 added equivalent handling for the Codex app-server process, along with hidden-window and process-tree cleanup behavior.
• #178 made Windows launches respect SHELL, preserving compatibility with Git Bash.

Those changes fixed important Windows behavior, but the shared command runner also handles Git. Unlike npm and codex, Git is directly executable on Windows and does not need shell-based .cmd resolution.

Changes

• Allow callers of runCommand to override its shell setting.
• Force shell: false in both Git command helpers.
• Apply the Git override after caller-provided options so it cannot be re-enabled accidentally.
• Add regression coverage for an automatically detected default branch containing shell-special characters.
• Update the test command helper to support an explicit shell setting when constructing the fixture.

The regression test verifies that the branch name is passed to Git literally and that an adjacent command helper is not executed.

Compatibility

The existing Windows behavior remains unchanged for commands that require it:

• npm and Codex .cmd discovery continues to use the configured Windows shell.
• Codex app-server startup continues to respect SHELL for Git Bash users.
• Existing Windows process-tree cleanup and hidden-window behavior are unaffected.
• macOS and Linux behavior is unchanged.

This approach avoids restricting valid Git reference names and confines the change to the command path that does not require shell expansion.

Validation

• npm test: 91 tests passed
• Focused Git tests: 11 tests passed
• git diff --check: clean