Locks the contract from PR #3102 / issue #3103: the shell option on the
execFileSync('npm', ...) call must be `process.platform === 'win32'`,
never an unconditional `shell: true`.
A regression to `shell: true` would silently change POSIX behavior
(spawn /bin/sh -c, signal/exit-code semantics shift, windowsHide can
lose effect on some Node versions) — exactly the cross-platform risk
flagged in the adversarial review.
Test approach:
- Reads worker source via readFileSync (hooks/*.js, outside the
lint-no-source-grep .cjs scope; allow-test-rule annotated with reason).
- Strips comments before checking for `shell: true` so prose mentions
in the JSDoc-style block comment do not trigger the regression check.
- Asserts execFileSync is still the spawn primitive (a swap to execSync
would silently shell-spawn on POSIX and defeat the gate).
- Why structural, not runtime: the win32 branch only manifests on a
Windows runner and the repo's CI is POSIX-only.
All 4 subtests pass. Lint-no-source-grep: clean.
