What this PR does

• Fixes the Node.js DEP0190 deprecation warning:

  [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities...
  

• Replaces the deprecated pattern:

  spawn(tool, ['run', 'vscode:prepublish'], { shell: true, ... });

  with the safe and supported string form:

  spawn(`${tool} run vscode:prepublish`, { shell: true, ... });

Why this matters

• Starting with Node.js 20, using shell: true with an argument array triggers a warning and is discouraged.
• This is a well-known Node.js issue documented here:
  DEP0190 (passing args to spawn with shell: true) isn't fixable when stdio option is required nodejs/node#58763

Why this is safe

• The tool value is controlled (npm or yarn), no user input is involved.
• The command is static and cannot be exploited.
• This form fully avoids the DEP0190 warning in all supported Node.js versions.

Additional improvements

• Extracts the command string into a prepublish variable for reuse in both logging and execution.
• Improves readability without changing behavior.