fix(cli): run Windows updater via structured cmd invocation

[mihneaptu]

Summary

• Run update commands on Windows via cmd /d /s /c <tool> <args> using structured process arguments.
• Keep non-Windows update execution unchanged.
• Add a unit test that validates the Windows wrapped invocation shape for npm updates.

Why

The previous Windows path executed cmd /C with a single pre-built command string. This is less robust than passing the tool and arguments as structured arguments, and can become brittle as command arguments evolve.

Changes

• Refactor run_update_action to use a shared update_command(...) builder.
• Add build_windows_update_command(...) helper that builds cmd arguments explicitly.
• Add test: windows_wrapped_update_command_includes_tool_and_args.

Notes

• This PR is intentionally scoped to updater command execution plumbing.
• I did not run a full workspace compile in this environment per request.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[mihneaptu]

I have read the CLA Document and I hereby sign the CLA

[mihneaptu]

recheck

[etraut-openai]

We've updated our contribution guidelines to indicate that we're no longer accepting unsolicited code contributions. All code contributions are by invitation only. To read more about why we've taken this step, please refer to this announcement.