fix(local-agents): Windows CLI detection + Hermes auth path

Detection reported installed npm-global agents (Claude Code, Codex) as
'binary not found on PATH' on Windows, and an authed Hermes desktop as
'NOT AUTHED'. Two root causes:

1. resolvePath() used POSIX-only 'command -v'/'which', and
   execFile/spawn('claude', ...) cannot resolve npm's .cmd shims via
   PATHEXT -> ENOENT -> installed:false. Add resolveBin() (where.exe on
   Windows, preferring .exe > .cmd > .bat) and route detection + both
   spawn call sites through the resolved path.

2. Hermes desktop on Windows stores its login under %LOCALAPPDATA%\hermes   not ~/.hermes/. Add localAppData() and check both (presence-only).

Windows .cmd shims are launched via a new spawnAgent() helper that invokes
cmd.exe with an argv ARRAY (shell:false) instead of shell:true, so the
untrusted prompt is never re-parsed by cmd.exe -> no command-injection surface.

No new deps; typecheck clean.

.gitignore

@@ -55,3 +55,5 @@ bench/nyu/
 # sensitive export leak-gate denylist (operator handle + embargoed disclosure
 # targets + personal vault) loaded by the exporter — never commit
 scripts/.export-denylist.local
+server.pid
+server.log