fix(cli): open the device-auth URL on Windows without cmd /c #2526

Defect

src/cli/auth-session.ts:559 spawns cmd /c start "" <url> with url = start.verificationUriComplete ?? start.verificationUri (:229), taken verbatim from the device-auth response. cmd /c re-tokenizes its argument string even when passed as argv, so &, ^, | in the URL are interpreted. This is the only shell-interpreting spawn left in the tree; all four exec.ts spawn paths are shell: false.

Fix

Launch via rundll32.exe url.dll,FileProtocolHandler <url> or explorer.exe <url> as inert argv. Validate the scheme is http/https and the string has no control characters before dispatch. No host allowlist: verification URIs can legitimately differ in origin from the API.

Done when

Unit test: a URL containing &calc never reaches a cmd spawn. Cannot be exercised on macOS; test-only.