fix(deps): use socket-lib 1.3.5 with Windows Proxy fix

Link to local socket-lib which includes the fix to preserve Windows
process.env Proxy behavior. This allows us to revert the socket-cli
workaround and use the standard env spreading pattern.

The fix is now in socket-lib where it belongs, benefiting all consumers.

Socket-lib changes:
- Only spread process.env when merging custom env vars
- Use process.env directly when no custom env provided
- Preserves Windows case-insensitive env access (PATH vs Path)

Related: socket-lib commit 5511966

Author: jdalton

package.json

@@ -32,7 +32,7 @@
     "@socketregistry/packageurl-js": "1.3.0",
     "@socketregistry/yocto-spinner": "1.0.24",
     "@socketsecurity/config": "3.0.1",
-    "@socketsecurity/lib": "1.3.4",
+    "@socketsecurity/lib": "link:../socket-lib",
     "@socketsecurity/registry": "2.0.0",
     "@socketsecurity/sdk": "3.0.6",
     "@types/cmd-shim": "5.0.2",

packages/cli/test/utils.mts

@@ -266,17 +266,13 @@ export async function spawnSocketCli(
   const commandArgs = isJsFile ? [entryPath, ...args] : args
 
   try {
-    // Only pass env if we have custom environment variables.
-    // The spawn function from @socketsecurity/lib/spawn ALWAYS spreads
-    // process.env first (line 622), then spreads our env on top.
-    // If we pass env with spread process.env, it gets spread multiple times
-    // losing Windows Proxy behavior. By passing undefined, spawn uses
-    // process.env directly without any spreading.
-    const env = spawnEnv ? { ...constants.processEnv, ...spawnEnv } : undefined
-
     const output = await spawn(command, commandArgs, {
       cwd,
-      env,
+      env: {
+        ...process.env,
+        ...constants.processEnv,
+        ...spawnEnv,
+      },
       ...restOptions,
       // Close stdin to prevent tests from hanging
       // when commands wait for input. Must be after restOptions