fix(hooks): add Windows .cmd support with shell injection guard

Handle Windows .cmd shim resolution via spawnSync with strict path
validation. Removes shell:true injection risk, uses strict equality,
and restores .cmd support with path injection guard.

scripts/lib/resolve-formatter.js

@@ -86,7 +86,7 @@ function detectFormatter(projectRoot) {
     const pkgPath = path.join(projectRoot, 'package.json');
     if (fs.existsSync(pkgPath)) {
       const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-      if (pkg.prettier != null) {
+      if ('prettier' in pkg) {
         formatterCache.set(projectRoot, 'prettier');
         return 'prettier';
       }