fix: resolve installer-owned npm through pnpm shell shims

[hetaoBackend]

Change

Refs #173. Installer-owned updates fail when pnpm exposes npm through a shell shim whose CLI lives under nodejs/<version>/lib/node_modules/npm/bin/npm-cli.js.

Add a fallback that reads the literal CLI target from the pnpm shell shim without executing or sourcing it. All exec branches must name the same supported target, and the resolved target must be a file inside that Node version's directory. The updater continues to invoke the CLI using its selected Node; existing receipt ownership checks, conventional npm symlinks, and Windows adjacent npm.cmd layouts are unchanged.

Validation

• Reproduced the reported error with synthetic pnpm directories before the fix; both direct and symlinked shim cases failed.
• PASS: focused update-application.test.ts suite (73 tests), including a real subprocess executing a synthetic npm CLI, paths containing spaces, multiple installed versions, conventional layouts, missing/invalid targets, dynamic paths, conflicting branches, and symlink escapes.
• PASS: git diff --check and pnpm typecheck.
• PASS: complete pnpm verify on clean commit 4547174aabbdb668914f21007c7ccae969d88f80, full profile, macOS arm64 / Node 26.4.0 / pnpm 9.12.0; all 14 applicable gates passed, including build, capability tests, offline BYOK, policy and sandbox checks.
• NOT RUN: real product upgrade, live registry acceptance, the reporter's exact OS/Node/pnpm combination, or local Linux/Windows execution. Windows layout is covered by a synthetic filesystem fixture; Unix symlink tests explicitly skip on Windows.

Publication and contribution checks

• I have permission to contribute these changes under the existing licenses applicable to the changed files/packages; no imported material is added and existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included.
• No source files were added/removed. Tests extend an already declared suite; no inventory regeneration is required.
• No documentation or capability contract changes are needed. Offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope or license changes: none.

Shared-source port: pending.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}