fix: eliminate command injection in hooks, fix pass-through newline corruption, add 8 tests

Replace shell: true with npx.cmd on Windows in post-edit-format.js and
post-edit-typecheck.js to prevent command injection via crafted file paths.
Replace console.log(data) with process.stdout.write(data) in
check-console-log.js to avoid appending extra newlines to pass-through data.

scripts/hooks/check-console-log.js

@@ -39,7 +39,7 @@ process.stdin.on('data', chunk => {
 process.stdin.on('end', () => {
   try {
     if (!isGitRepo()) {
-      console.log(data);
+      process.stdout.write(data);
       process.exit(0);
     }
 
@@ -65,5 +65,5 @@ process.stdin.on('end', () => {
   }
 
   // Always output the original data
-  console.log(data);
+  process.stdout.write(data);
 });