[thekevinbot]

Fixes #1207
Part of #1191

On Windows, run_command now pushes every argv element through CommandExt::raw_arg, quoted by the MS C-runtime rules (always wrapped in ", backslashes before a " or the closing quote doubled, embedded " escaped). MSYS/Cygwin children no longer glob or brace-expand on-file argv; MSVCRT children parse the same values as before. The quoting is a pure function, unit-tested on every platform; only the raw_arg wiring is cfg(windows).

Not covered here: inside quotes MSYS still collapses \\ to \, so a verbatim \\?\ path differs between runtimes. That is #1208.

Windows compile: the crate cannot be cross-checked locally (bundled SQLite needs x86_64-w64-mingw32-gcc), so the exact quote_windows_arg / push_args source was extracted into a scratch crate and passes cargo clippy --target x86_64-pc-windows-gnu -- -D warnings. The Windows CI job (#1178) is not on main yet.

E2E Verification

• Ran e2e suites locally for every affected SDK
• Python SDK e2e: pass
• TypeScript SDK e2e: pass
• Rust core e2e (if applicable): pass
• packages/python/e2e-attestations/<branch>.json receipt written if packages/python changed (just e2e-attest-python)
• packages/ts/e2e-attestations/<branch>.json receipt written if packages/ts changed (just e2e-attest-ts)
• Command(s) run: cargo test --workspace --features cli -- --test-threads=2, just e2e-attest-python, just e2e-attest-ts, just preflight
• Result summary: Rust all green; Python 38 passed, 4 xfailed; TS 18 passed. At default parallelism two cli_e2e watcher tests failed with Too many open files (host inotify instances at 111/128 from other processes); both pass at --test-threads=2 and in isolation. Hand check on Linux: an on-file hook passing 'a?b*{}' receives it verbatim.

Changelog / Migrations

• Changelog fragment added under packages/rust/changelog.d/
• Migration fragment added under packages/rust/migrations.d/ (Windows MSYS children no longer expand argv)