fix: harden cross-platform paths and child-process handling

Replace process.env.HOME fallbacks with os.homedir() in dashboard usage
probes and the hermes plugin profile resolver so unset HOME no longer
yields literal "~" paths. Skip POSIX process-group semantics on Windows
in engine/merger and dashboard-tui's pgrep-based vitest killer. Add
shell: true to npx spawns in CLI skills/extension so .cmd shims resolve
on Windows, and route test:build-exe through cross-env.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/cli/src/commands/dashboard-tui/controller.ts

@@ -272,6 +272,10 @@ export class DashboardTUI {
    * gone by the time we send the signal).
    */
   killVitestProcesses(): { killed: number; pids: number[] } {
+    // pgrep is POSIX-only; Windows path is a no-op above.
+    if (process.platform === "win32") {
+      return { killed: 0, pids: [] };
+    }
     const selfPid = process.pid;
     let pids: number[] = [];
     try {

packages/cli/src/commands/skills.ts

@@ -187,6 +187,7 @@ export async function runSkillsInstall(
   const child = spawn("npx", npxArgs, {
     cwd: process.cwd(),
     stdio: "inherit",
+    shell: true,
   });
 
   const exitCode = await new Promise<number>((resolve, reject) => {

packages/cli/src/extension.ts

@@ -1791,6 +1791,7 @@ export default function kbExtension(pi: ExtensionAPI) {
       const child = spawn("npx", npxArgs, {
         cwd: resolveProjectRoot(ctx.cwd),
         stdio: "pipe",
+        shell: true,
       });
 
       let stderr = "";
@@ -1895,6 +1896,7 @@ export default function kbExtension(pi: ExtensionAPI) {
         stdio: ["ignore", "pipe", "pipe"],
         detached: false,
         env: { ...process.env },
+        shell: true,
       });
 
       dashboardProcess = child;