fix(windows): use full path to where.exe for reliable executable lookup (#1659)

* fix(windows): use full path to where.exe for reliable executable lookup

Use full path to where.exe (C:\Windows\System32\where.exe) instead of
relying on it being in PATH. This fixes issues in restricted environments
or when Electron doesn't inherit the full system PATH.

Changes:
- Export getWhereExePath() from windows-paths.ts as single source of truth
- Update getWhichCommand() in paths.ts to use the shared helper
- Fix shell injection vulnerability in release-handlers.ts by using
  execFileSync with array arguments instead of string template
- Standardize SystemRoot env var fallback (check both SystemRoot and
  SYSTEMROOT variants) for consistency across all usages

Co-Authored-By: Claude Opus 4.5 <[email protected]>

* fix: resolve CI failures from outdated develop branch

- Fix Ruff formatting in parallel_orchestrator_reviewer.py and pydantic_models.py
- Fix test_integration_phase4.py to register module in sys.modules before
  exec_module for Python 3.12+ dataclass compatibility

Co-Authored-By: Claude Opus 4.5 <[email protected]>

---------

Co-authored-by: Claude Opus 4.5 <[email protected]>
Co-authored-by: Andy <[email protected]>

apps/frontend/src/main/ipc-handlers/github/release-handlers.ts

@@ -19,8 +19,7 @@ import { getWhichCommand } from '../../platform';
  */
 function checkGhCli(): { installed: boolean; error?: string } {
   try {
-    const checkCmd = `${getWhichCommand()} gh`;
-    execSync(checkCmd, { encoding: 'utf-8', stdio: 'pipe' });
+    execFileSync(getWhichCommand(), ['gh'], { encoding: 'utf-8', stdio: 'pipe' });
     return { installed: true };
   } catch {
     return {

apps/frontend/src/main/platform/paths.ts

@@ -298,11 +298,14 @@ export function getOllamaInstallCommand(): string {
 /**
  * Get the command to find executables in PATH
  *
- * Windows: where.exe
+ * Windows: Full path to where.exe (C:\Windows\System32\where.exe)
+ *          Using full path ensures it works even when System32 isn't in PATH,
+ *          which can happen in restricted environments or when Electron doesn't
+ *          inherit the full system PATH.
  * Unix: which
  */
 export function getWhichCommand(): string {
-  return isWindows() ? 'where.exe' : 'which';
+  return isWindows() ? getWhereExePath() : 'which';
 }
 
 /**