ci: close Windows npm portability gap

[jayzeng]

Why

The Windows GA path was under-tested in two places:

• external-command path tests could simulate platform: win32 while still using the host OS path implementation, so Linux could "verify" a non-native Windows path shape
• Core CI never exercised the actual npm-generated agent-memory.cmd that Windows npm users invoke

What

• resolve the fixed private companion path with path.win32 on Windows and path.posix elsewhere
• make the Windows resolver test assert a literal native Windows path rather than deriving its expectation with the host path module
• add a windows-latest package smoke job that runs CLI tests, npm pack, installs the tarball into a clean prefix, verifies npm created agent-memory.cmd, and executes agent-memory.cmd version

Scope

No product/account/plugin behavior is added to MIT Core. The fixed external command handoff remains the only extension seam.

The private companion PR separately exercises the full Windows npm shim -> Core launcher -> native companion -> Core-version round trip, so this PR keeps Core's CI independent of private source.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.