fix: use .exe PATH fallback so PATHEXT cannot run node.js

[dyk1454683243-sudo]

Fixes #71

Cause

On Windows, cmd.exe resolves an extensionless command by searching the current directory first, then PATH, appending each PATHEXT entry. Default PATHEXT includes .JS, so a file named node.js in cwd (or earlier on PATH) is executed instead of node.exe. Asking users to remove .JS from PATHEXT is not acceptable — it is the Windows default.

#64 moved set PATHEXT=%PATHEXT:;.JS;=;% to after endLocal so the strip can take effect. That substitution only removes a middle ;.JS; entry. It does not remove .JS when it is first (.JS;.COM;...) or last (.COM;...;.JS). The PATH fallback remained the extensionless name node, so any failed or partial strip still launches node.js. The same search applies to other env bins (python → python.js).

Fix

When the interpreter is a simple command name, the .cmd shim PATH fallback is now prog.exe (node.exe, python.exe) instead of node. cmd.exe looks up that exact name and cannot match node.js.

This matches the existing %dp0%\node.exe check and the PowerShell shim (node$exe → node.exe on Windows).

• Interpreters that already end in .exe are left as-is
• Pathed interpreters (/usr/bin/sh) are unchanged (not PATHEXT-searched)
• The existing PATHEXT .JS strip is kept as defense in depth

Tests

• PATHEXT mock of cmd.exe cwd search: bare node is shadowed by node.js; node.exe is not, including when .JS is first or last
• Generated .cmd shims assert SET "_prog=node.exe" / python.exe
• Snapshots updated for env shebangs

Separate from #190 (UTF-8 BOM). No open PR already claimed #71.

[dyk1454683243-sudo]

Withdrawing this PR while I clean up a high-volume open-PR backlog. Sorry for the noise — happy to come back later with a focused change if useful.