fix: quote parameters correctly for cmd.exe custom tools

[awhite0030]

Description

Brief description of what this PR does

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Changeset

• Added a changeset (pnpm changeset) describing this change for the changelog

Docs-only or internal chores need no changeset (or run pnpm changeset --empty to note that intentionally).

Testing

Automated Tests

• New features include passing tests in .spec.ts/tsx files
• All existing tests pass (pnpm test:all completes successfully)
• Tests cover both success and error scenarios

Manual Testing

• Tested with Ollama
• Tested with OpenRouter
• Tested with OpenAI-compatible API
• Tested MCP integration (if applicable)

Checklist

• If this was for an open issue, I was assigned to it
• Code follows project style guidelines
• Self-review completed
• Documentation updated (if needed)
• No breaking changes (or clearly documented)
• Appropriate logging added using structured logging (see CONTRIBUTING.md)

---

Root cause: The custom tool template engine universally applied POSIX single-quote escaping for all arguments (renderValue -> shellQuote). On Windows cmd.exe, this resulted in strings wrapped in literal ' marks, breaking file paths and failing to prevent shell injection vectors from characters like & and %VAR%.

Fix: Extracted isWindowsCmd from handler.ts and introduced a cmdQuote function in template.ts that escapes metacharacters %, &, |, <, >, and ^ by prefixing them with ^ and wrapping the argument in double quotes. The template renderer now takes the shell as an optional parameter and uses cmdQuote if it detects a Windows cmd shell.

Validation:

pnpm run build
pnpm test:format
pnpm test:lint
pnpm test:types
pnpm test:knip
pnpm test:ava source/custom-tools/*.spec.ts

(Note: Only custom-tools tests were run via ava due to container environment timeouts)

Fixes #1084

Fixes #1084