fix(runner): replace shell:true with cross-spawn, add resolveClaude
- Remove shell:true from runner.ts (command injection vector closed)
- Import cross-spawn instead of child_process.spawn; add windowsHide:true
- Add src/runtime/resolve-claude.ts: CLAUDE_PATH env override, where/which
PATH fallback, in-memory cache, clear error message on not-found
- Add tests/unit/resolve-claude.test.ts: 5 Vitest tests covering env override,
PATH fallback, multi-line output trimming, error case, and cache behaviour
- Add cross-spawn + @types/cross-spawn to package.json; add vitest + test script
bade6d07f6