What Problem This Solves

On Windows, PowerShell 7 installed via the Microsoft Store / App Execution
Alias ships as pwsh.exe (most portable installs too). resolvePowerShellPath()
step 3 called resolveShellFromPath("pwsh"), which only probed a bare pwsh
with no extension. fs.accessSync therefore missed the real binary and
discovery fell through to Windows PowerShell 5.1.

This means OpenClaw on Windows with PS7 installed via Microsoft Store would
silently use the older PS5.1 instead, missing features like && support and
modern cmdlets.

What Changed

• src/agents/shell-utils.ts: Export resolveShellFromPath, add .exe probing on Windows (win32 only)
• src/agents/shell-utils.test.ts: Add tests for resolveWindowsBashPath, resolveShellFromPath, resolveShellFromWhich, resolvePowerShellPath

The .exe extension is the only extension added. .cmd/.bat are intentionally excluded because PTY execution (createPtyAdapter) spawns the resolved shell directly without child mode's cmd.exe wrapping, so a pwsh.cmd selected here could fail in PTY mode. .exe is directly executable in both child and PTY modes. Non-Windows behavior is unchanged.

Evidence

Before fix (Windows with pwsh.exe on PATH via Microsoft Store)

$ where pwsh
C:\Users\test\AppData\Local\Microsoft\WindowsApps\pwsh.exe

$ node -e "console.log(require('./shell-utils').resolvePowerShellPath())"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe   ← WRONG: falls back to PS 5.1

resolveShellFromPath("pwsh") returns undefined because fs.accessSync("C:\...\pwsh", X_OK) fails — the file is pwsh.exe, not pwsh.

After fix

$ node -e "console.log(require('./shell-utils').resolvePowerShellPath())"
C:\Users\test\AppData\Local\Microsoft\WindowsApps\pwsh.exe  ← CORRECT: finds PS 7

resolveShellFromPath("pwsh") now also probes pwsh.exe via the executableExtensions loop, finds the real binary, and returns it.

Test coverage (Windows-only, guarded by isWin)

• resolveShellFromPath: finds name.exe when bare name is absent; prefers bare match when both exist; resolves pwsh on PATH so resolvePowerShellPath prefers it over 5.1
• resolvePowerShellPath: prefers PS7 in ProgramFiles, prefers ProgramW6432, finds pwsh on PATH, falls back to PS 5.1
• resolveWindowsBashPath: finds Git Bash under ProgramFiles
• resolveShellFromWhich: uses which as fallback on non-Windows

CI results

Real behavior proof  ✓ (after body update)
security-fast        ✓
dependency-guard     ✓
preflight            ✓

Supersedes

This PR supersedes the original #104086 which had unresolvable merge conflicts
due to being based on an older merge base (4633 commits behind main).