fix: cross-platform external check commands

[PatrickDinh]

What

• External check commands run as argv arrays with no shell; args after -- reach the tool as literal entries — never re-split or glob-expanded.
• The installed-tool probe understands Windows .CMD/.EXE bin shims (PATHEXT).
• verifyx eject writes scripts quoted for both POSIX and Windows npm scripts, and fails at eject time on args it can't quote portably.
• verify:circular-deps scaffolds as plain verifyx circular-deps (skott scans the project by default); failure hints print the exact argv.

Why

verifyx duplicate-code -- --ignore '**/generated/**' ignored nothing. Passthrough args were joined unquoted into a single shell string, so /bin/sh glob-expanded the pattern and jscpd received --ignore src/generated/a.ts src/generated/b.ts — a single-file ignore plus a stray scan path. The same joining word-split any arg with a space.

Windows failed the opposite way: cmd.exe never expands globs, so the scaffolded verifyx circular-deps -- src/*.ts handed skott a literal src/*.ts and failed on every Windows machine. With shell strings, each argument's fate depends on which shell re-parses it — so no shell gets to see the arguments at all.

How

checkCommand/fixCommand are now readonly string[], spawned with shell: false via cross-spawn (new runtime dependency — plain shell-less spawn can't run node_modules/.bin .cmd shims on Windows). Consumer-owned verify:* script overrides are user-authored strings and still run through the platform shell, unchanged.

Verified manually with before/after tarballs on real Windows + Linux:

Scenario	Before	After
Linux: duplicate-code -- --ignore '**/generated/**'	exit 1 — ignore glob destroyed	exit 0
Windows: scaffolded verify:circular-deps, clean project	exit 1 — literal src/*.ts not found	exit 0
Windows: circular-deps -- "my src/index.ts"	exit 1 — arg word-split	exit 0
Both: duplicate-code with real duplicates	exit 1	exit 1

[staff0rd]

my agents had nothing to say about this :0