bug(ci): pre-commit hook cannot spawn biome.cmd on Windows (EINVAL) #5668

What happened

On Windows, every git commit fails in the husky pre-commit hook before any check runs:

Error: spawnSync D:\work\code\maka-agent\node_modules\.bin\biome.cmd EINVAL
    at checkStagedWithBiome (scripts/biome-staged-check.mjs:112:20)
husky - pre-commit script failed (code 1)

scripts/biome-staged-check.mjs resolves node_modules/.bin/biome.cmd on win32 and runs it with spawnSync without a shell. Since the CVE-2024-27980 fix, Node refuses to spawn .cmd/.bat files without shell: true and throws EINVAL. Windows contributors can therefore only commit with --no-verify, which also skips the ASF header, protocol epoch, and git diff --check steps.

Running the platform binary directly works: node_modules/@biomejs/cli-win32-x64/biome.exe check <files> passes on the same files.

How to reproduce

1. On Windows with Node 22.23.1 (any release after the April 2024 security fix), run npm ci.
2. Stage any .ts change and run git commit.
3. The hook exits with spawnSync …\biome.cmd EINVAL.

Environment

• Windows 10 x64 (10.0.19042), Node v22.23.1, npm per packageManager
• apache/main@fef5b937a

Logs, screenshots, or additional context

Possible fixes: resolve the native @biomejs/cli-win32-*/biome.exe on Windows, or invoke Biome through node with its JS entry point. Avoid shell: true, because the hook feeds staged file content on stdin and passes paths as arguments.