fix(hooks): scope shell:true to Windows + add changeset

Address adversarial review feedback on PR #3102:

1. shell:true is now conditional (process.platform === 'win32')
   - POSIX path unchanged: no shell spawn, no overhead, original
     signal/exit-code semantics and windowsHide effect preserved
   - Windows path: still routes through cmd.exe to resolve npm.cmd
     via PATHEXT (the actual fix for ENOENT)

2. Added .changeset/windows-npm-shell-fix.md (Fixed type)

Reviewed feedback resolved:
- Cross-platform regression risk → shell now Windows-only
- Missing changeset → added

.changeset/windows-npm-shell-fix.md

@@ -0,0 +1,5 @@
+---
+type: Fixed
+---
+
+**Windows update-check no longer silently fails** — `gsd-check-update-worker` now passes `shell: true` only on Windows, allowing `execFileSync('npm', ...)` to resolve `npm.cmd` via PATHEXT. POSIX path (Linux/macOS) is unchanged. Without this fix, the worker failed with ENOENT, `latest` stayed `null`, `update_available` became `null`, and the statusline `⬆ /gsd-update` indicator never rendered for Windows users. Fixes #3103.

hooks/gsd-check-update-worker.js

@@ -93,11 +93,13 @@ try {
     encoding: 'utf8',
     timeout: 10000,
     windowsHide: true,
-    // shell:true is required on Windows so 'npm' resolves to npm.cmd via PATHEXT.
-    // Without it, execFileSync looks for a literal 'npm' binary, fails with ENOENT,
-    // the catch swallows the error, latest stays null, and the statusline never shows
-    // the "⬆ /gsd-update" indicator on Windows.
-    shell: true,
+    // On Windows, 'npm' is distributed as npm.cmd. Node's execFileSync does
+    // not apply PATHEXT resolution and looks for a literal 'npm' binary,
+    // failing with ENOENT. Setting shell:true on Windows routes through
+    // cmd.exe which resolves npm.cmd via PATHEXT.
+    // POSIX (Linux/macOS) is left untouched — no shell spawn, no extra
+    // signal/exit-code semantics, no overhead.
+    shell: process.platform === 'win32',
   }).trim();
 } catch (e) {}