fix: harden cross-platform paths and child-process handling

Replace process.env.HOME fallbacks with os.homedir() in dashboard usage
probes and the hermes plugin profile resolver so unset HOME no longer
yields literal "~" paths. Skip POSIX process-group semantics on Windows
in engine/merger and dashboard-tui's pgrep-based vitest killer. Add
shell: true to npx spawns in CLI skills/extension so .cmd shims resolve
on Windows, and route test:build-exe through cross-env.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/cli/src/commands/dashboard-tui/controller.ts

@@ -272,6 +272,10 @@ export class DashboardTUI {
    * gone by the time we send the signal).
    */
   killVitestProcesses(): { killed: number; pids: number[] } {
+    // pgrep is POSIX-only; Windows path is a no-op above.
+    if (process.platform === "win32") {
+      return { killed: 0, pids: [] };
+    }
     const selfPid = process.pid;
     let pids: number[] = [];
     try {