fix: invoke pnpm via npm_execpath on Windows (fixes #19)

[Sainigurnoor511]

Summary

• Add \scripts/pnpm-command.mjs\ to resolve pnpm invocations on Windows without a shell: when
  pm_execpath\ points at pnpm's .cjs/.mjs\ entry (as under \pnpm run), run
  ode ...\ so argv boundaries survive intact.
• Reject
  pm-cli.js\ via the path guard so
  pm run\ does not silently use the wrong package manager.
• Update all nested pnpm call sites on the local dev path, plus \scripts/generate-worker-types.mjs\ (flagged in pnpm run-local cannot start on Windows: spawnSync pnpm ENOENT #19).
• Surface spawn failures in \generate-worker-types.mjs\ when
  esult.error\ is set (misleading wrangler error today).

Fixes #19

Approach

Follows the approach discussed in #19 / @snowyukitty's analysis: no shell, no .cmd\ shim, arguments stay intact (including checkout paths with spaces).

Test plan

• Windows 10 (10.0.26200), Node v24.16.0, pnpm 11.17.0, path \E:\Projects\cloudflare-os\ (no spaces): \pnpm run-local\ completes install/build and reaches wrangler ready on port 8787
• Checkout path containing a space (regression case from pnpm run-local cannot start on Windows: spawnSync pnpm ENOENT #19)
• \pnpm types:generate\ on Windows

CLA

I have read the CLA Document and I hereby sign the CLA

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Sainigurnoor511]

I have read the CLA Document and I hereby sign the CLA

[snowyukitty]

I tested the exact PR head (b289c1a) against the regression case from #19:

• Windows, Node 22.22.3, pnpm 11.17.0
• checkout path containing a space
• cold pnpm run-local, through install, both app builds, Wrangler custom builds, and startup
• GET / returned HTTP 200 (653 bytes)

So the core npm_execpath approach in this revision does preserve argv boundaries in a path containing a space. I did not run pnpm types:generate separately.

Two current-main deltas are worth knowing before anyone rebases it:

1. main is now at ba4036b, and GitHub reports this branch as conflicting. The Vite+ dev-server work added two asynchronous bare-pnpm preflight calls at run-dev-server.js:261-264. Those still need the same Windows-safe executable/argv resolution, but this helper currently wraps only execFileSync and spawnSync. In the same environment, a direct spawnSync("pnpm", ["--version"]) on current main returns ENOENT.
2. scripts/release/build-release.mjs documents direct node scripts/release/build-release.mjs ... invocation. In that entry path npm_execpath is not guaranteed, so this revision's helper falls back to bare pnpm; routing that call site through execPnpm() does not by itself make the direct Windows path work. I would leave it out unless the release script gets an explicit pnpm-entry contract.

One process caveat: the contribution-policy automation landed after this PR and now closes non-exempt external PRs over 30 changed lines on synchronize; this PR is currently 60 additions / 16 deletions. I would wait for maintainer direction before spending time on a rebase.

AI tools assisted the investigation. The environment, HTTP response, and spawn result above are measurements from the runs described, not predicted outcomes.