fix(desktop): hide Windows selected app subprocesses

[hereswilson]

Issue for this PR

Fixes #31938
Refs #31629

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

While checking #31629, I found a related Windows Desktop path: opening a file with a selected app can spawn subprocesses for app resolution or launch. Those subprocesses should use hidden process creation too.

This PR fixes the selected app open path tracked in #31938. It does not claim to fix the shell tool or MCP subprocess path described in #31629.

Desktop subprocess creation for this path now goes through hidden child process helpers. Commands that need stdout or exit status use hidden execFile; Windows selected app launches use hidden spawn and resolve after the child starts instead of waiting for the app to exit.

Because validating resolved app paths adds cold path work, this PR also keeps valid resolved app paths in a bounded cache, retries stale cached paths once through the resolver, and leaves missing apps uncached. Stale paths, unreadable shims, malformed resolver output, and unresolved .cmd or .bat shims are treated as unresolved instead of launchable.

After adding that validation, I found one more stale Windows resolver case worth tightening: when where returns repeated stale paths, the fuzzy fallback scan could read the same directories over and over. The resolver now deduplicates those fallback directories and caps that scan at the app path cache size. The cap is tied to APP_PATH_CACHE_LIMIT so the fallback search uses the same scale as the cache it feeds.

macOS and Linux routing is covered by unit tests, but native UX verification was not done on those OSes. This PR should be reviewed as a Windows selected app launch fix.

How did you verify your code works?

From packages/desktop:

• bun test src/main/apps.test.ts src/main/open-path.test.ts src/app-path-cache.test.ts src/main/child-process.test.ts src/renderer/open-path.test.ts --timeout 30000
• bun typecheck

Also ran the repository push hook through git push origin hide-windows-spawn; it ran bun turbo typecheck and passed.

I also used local benchmark checks around the Windows stale resolver path. The repeated stale directory case dropped from about p50 781ms to p50 39ms after deduping and bounding the fallback scan. A local cap sweep showed scan cost rises with the cap, so the fallback limit now follows the existing app path cache limit rather than using an unrelated number.

Screenshots / recordings

N/A. This changes Windows subprocess launch behavior, not persistent app UI.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[hereswilson]

Scope correction: I changed this from Closes #31629 to Refs #31629. The issue is specifically about shell tool and MCP subprocesses, while this PR fixes a related Windows Desktop selected app open path that also creates subprocesses. I am checking the shell/MCP path separately.

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.