Add cmd.exe fallback when wscript.exe is unavailable

This changes Windows restart execution to depend entirely on wscript.exe; in hardened Windows environments where Windows Script Host is disabled or blocked, spawn("wscript.exe", ...) fails and the update path no longer performs an automatic restart (it only falls back to a warning in maybeRestartService). Previously, direct cmd.exe execution still restarted the gateway, so this is a behavioral regression for those setups; consider catching this failure and falling back to the old cmd.exe /d /s /c ... path.

Useful? React with 👍 / 👎.

Backslash doubling is wrong for VBScript

VBScript strings do not use \ as an escape character — backslashes are treated literally. The .replace(/\\/g, "\\\\") call writes C:\\Users\\...\\script.bat into the .vbs file instead of C:\Users\...\script.bat. While Windows path APIs often normalise double-backslashes, this is technically incorrect and breaks for UNC paths (e.g. \\server\share\script.bat becomes \\\\server\\share\\script.bat, which is a different UNC root).

Only the quote-doubling step is needed for VBScript string embedding:

This is a comment left during a code review.
Path: src/cli/update-cli/restart-helper.ts
Line: 174

Comment:
**Backslash doubling is wrong for VBScript**

VBScript strings do not use `\` as an escape character — backslashes are treated literally. The `.replace(/\\/g, "\\\\")` call writes `C:\\Users\\...\\script.bat` into the `.vbs` file instead of `C:\Users\...\script.bat`. While Windows path APIs often normalise double-backslashes, this is technically incorrect and **breaks for UNC paths** (e.g. `\\server\share\script.bat` becomes `\\\\server\\share\\script.bat`, which is a different UNC root).

Only the quote-doubling step is needed for VBScript string embedding:

```suggestion
    const quotedBat = scriptPath.replace(/"/g, '""');
```

How can I resolve this? If you propose a fix, please make it concise.

Off-by-one in VBScript quote scheme produces a trailing stray " in the cmd.exe argument

The template literal has 4 " before ${quotedBat} and 7 " after it. After VBScript's "" → " decoding the Run argument becomes:

cmd.exe /d /s /c ""<path>"""

With cmd.exe /d /s /c, the /s flag strips the first and last " of the argument string, yielding "<path>"". The extra trailing " is passed as an empty argument to the batch script. While in practice most batch scripts ignore unexpected arguments, this is still incorrect.

The correct pattern to have cmd.exe receive "<path>" (i.e., one "" pair on each side in the VBScript string) needs 4 before + 5 after:

This is a comment left during a code review.
Path: src/cli/update-cli/restart-helper.ts
Line: 177

Comment:
**Off-by-one in VBScript quote scheme produces a trailing stray `"` in the cmd.exe argument**

The template literal has **4 `"`** before `${quotedBat}` and **7 `"`** after it. After VBScript's `""` → `"` decoding the `Run` argument becomes:

```
cmd.exe /d /s /c ""<path>"""
```

With `cmd.exe /d /s /c`, the `/s` flag strips the **first and last** `"` of the argument string, yielding `"<path>""`. The extra trailing `"` is passed as an empty argument to the batch script. While in practice most batch scripts ignore unexpected arguments, this is still incorrect.

The correct pattern to have cmd.exe receive `"<path>"` (i.e., one `""` pair on each side in the VBScript string) needs **4 before + 5 after**:

```suggestion
      `ws.Run "cmd.exe /d /s /c """"${quotedBat}""""", 0, False`,
```

How can I resolve this? If you propose a fix, please make it concise.

No error handling around VBScript file write

Previously, runRestartScript only called spawn (synchronous, never throws). Adding await fs.writeFile(...) introduces a new failure mode: if the write fails (disk full, permissions), the function rejects and the gateway restart silently fails. Consider wrapping the Windows path in a try/catch to fall back gracefully, similar to how prepareRestartScript already does:

try {
  await fs.writeFile(vbsPath, vbsContent, "utf8");
} catch {
  // Fall back: run the bat directly (console flash may be visible but restart succeeds)
  const child = spawn("cmd.exe", ["/d", "/s", "/c", scriptPath], {
    detached: true,
    stdio: "ignore",
    windowsHide: true,
  });
  child.unref();
  return;
}

This is a comment left during a code review.
Path: src/cli/update-cli/restart-helper.ts
Line: 182-189

Comment:
**No error handling around VBScript file write**

Previously, `runRestartScript` only called `spawn` (synchronous, never throws). Adding `await fs.writeFile(...)` introduces a new failure mode: if the write fails (disk full, permissions), the function rejects and the gateway restart silently fails. Consider wrapping the Windows path in a try/catch to fall back gracefully, similar to how `prepareRestartScript` already does:

```typescript
try {
  await fs.writeFile(vbsPath, vbsContent, "utf8");
} catch {
  // Fall back: run the bat directly (console flash may be visible but restart succeeds)
  const child = spawn("cmd.exe", ["/d", "/s", "/c", scriptPath], {
    detached: true,
    stdio: "ignore",
    windowsHide: true,
  });
  child.unref();
  return;
}
```

How can I resolve this? If you propose a fix, please make it concise.

Escape cmd expansion chars in Windows restart path

The new Windows wrapper only escapes double quotes (scriptPath.replace(/"/g, '""')) before embedding the batch path into cmd.exe /d /s /c, but cmd.exe still expands %VAR% inside quoted strings. If the temp/script path contains a literal % (valid on NTFS and possible via custom TEMP), the command line is rewritten and the .bat path can no longer be resolved, so auto-restart silently fails. The prior implementation used quoteCmdScriptArg to escape %/!; that escaping needs to be preserved for the VBS command string (and fallback cmd.exe path).

Useful? React with 👍 / 👎.