fix: harden cross-platform paths and child-process handling

Replace process.env.HOME fallbacks with os.homedir() in dashboard usage
probes and the hermes plugin profile resolver so unset HOME no longer
yields literal "~" paths. Skip POSIX process-group semantics on Windows
in engine/merger and dashboard-tui's pgrep-based vitest killer. Add
shell: true to npx spawns in CLI skills/extension so .cmd shims resolve
on Windows, and route test:build-exe through cross-env.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/engine/src/merger.ts

@@ -27,10 +27,12 @@ async function execWithProcessGroup(
       return;
     }
 
+    const useProcessGroup = process.platform !== "win32";
+
     const child = spawn(command, {
       cwd: options.cwd,
       shell: true,
-      detached: true,
+      detached: useProcessGroup,
       stdio: ["ignore", "pipe", "pipe"],
     });
 
@@ -44,7 +46,13 @@ async function execWithProcessGroup(
 
     const killTree = (sig: NodeJS.Signals) => {
       if (child.pid === undefined) return;
-      try { process.kill(-child.pid, sig); } catch { /* group may already be gone */ }
+      try {
+        if (useProcessGroup) {
+          process.kill(-child.pid, sig);
+        } else {
+          child.kill(sig);
+        }
+      } catch { /* group may already be gone */ }
     };
 
     const timer = setTimeout(() => {