* fix(cli): spawn opencode.cmd shim with shell:true on win32 (#7913)
runOpenCodeAuth spawned the opencode.cmd shim with shell:false on win32,
which throws spawnSync EINVAL under Node's hardened child_process
handling (post CVE-2024-27980). Mirrors the fix already applied to
codex (resolveCodexSpawn in launch-codex.mjs, #6263) and
qodercli/Auggie (#6263/#6304): shell:isWin, unchanged elsewhere.
Exported runOpenCodeAuth for testability and added a regression test
covering both the win32 shell:true path and the non-regressing
linux/darwin bare-binary path.
* fix(cli): make opencode --auth win32 spawn testable without module mocks (#7913)
The regression test used t.mock.module, which needs --experimental-test-module-mocks
and fails to even run in CI (TypeError: t.mock.module is not a function → the fix was
unvalidated). Extract a pure resolveOpenCodeAuthSpawn(providerId, platform) helper and
test it directly (win32 → shell:true, linux/darwin → shell:false). Production behavior
of runOpenCodeAuth is unchanged.
