Fix Windows spawn ENOENT for package managers

Three fixes for Windows compatibility:
1. Use pnpmExecPath constant to find pnpm executable (similar to npmExecPath)
2. When spawning with just a command name on Windows (not a full path),
   append .cmd extension for package managers to ensure Windows can find them
3. Add Windows-specific paths in findRealPnpm for common pnpm locations

This should resolve optimize test failures on Windows CI where 'spawn pnpm ENOENT'
errors were occurring because pnpm couldn't be found in PATH.

Author: jdalton

src/utils/agent.mts

@@ -1,9 +1,16 @@
+import path from 'node:path'
+
 import { logger } from '@socketsecurity/registry/lib/logger'
 import { getOwn } from '@socketsecurity/registry/lib/objects'
 import { spawn } from '@socketsecurity/registry/lib/spawn'
 import { Spinner } from '@socketsecurity/registry/lib/spinner'
 
-import constants, { NPM, PNPM } from '../constants.mts'
+import constants, {
+  NPM,
+  PNPM,
+  YARN_BERRY,
+  YARN_CLASSIC,
+} from '../constants.mts'
 import { cmdFlagsToString } from './cmd.mts'
 import { shadowNpmInstall } from '../shadow/npm/install.mts'
 
@@ -61,7 +68,19 @@ export function runAgentInstall(
     logger.error(`  agentExecPath: ${agentExecPath}`)
   }
 
-  return spawn(agentExecPath, installArgs, {
+  // On Windows with shell: true, if we get just the command name (not a full path),
+  // we need to append .cmd for package managers to work correctly.
+  let command = agentExecPath
+  if (
+    constants.WIN32 &&
+    !agentExecPath.includes(path.sep) &&
+    (agent === PNPM || agent === YARN_CLASSIC || agent === YARN_BERRY)
+  ) {
+    // If it's just a command name like 'pnpm' (no path separator), add .cmd for Windows.
+    command = `${agentExecPath}.cmd`
+  }
+
+  return spawn(command, installArgs, {
     cwd: pkgPath,
     shell: constants.WIN32,
     spinner,

src/utils/package-environment.mts

@@ -223,6 +223,15 @@ async function getAgentExecPath(agent: Agent): Promise<string> {
     // Fall back to whichBin.
     return (await whichBin(binName, { nothrow: true })) ?? binName
   }
+  if (binName === PNPM) {
+    // Try to use constants.pnpmExecPath first, but verify it exists.
+    const pnpmPath = constants.pnpmExecPath
+    if (existsSync(pnpmPath)) {
+      return pnpmPath
+    }
+    // Fall back to whichBin.
+    return (await whichBin(binName, { nothrow: true })) ?? binName
+  }
   return (await whichBin(binName, { nothrow: true })) ?? binName
 }