W-23814642- resolve npm from PATH only, excluding CWD

[soridalac]

What does this PR do?

Summary

• Resolve npm via which and reject if it resolves to CWD in the sf-doctor diagnostic hook
• Use execFile with the resolved absolute path instead of exec with a bare command name
• Add { shell: true } only when the resolved path is a .cmd/.bat file

Test plan

• Verified on Windows VM: npm.exe in CWD no longer executes via sf doctor
• Verified on Windows VM: sf doctor auth diagnostics run normally from a clean directory
• Unit tests pass (89 passing)

What issues does this PR fix or reference?

@W-23814642@

[WillieRuemmele]

QA Notes

---

✅ :

plugin-auth.mov