spawnSync on a .cmd shim returns EINVAL/null status on recent Node (CVE-2024-27980) unless shell:true, which made postinstall fail and blocked every 'pnpm run' on Windows. (cherry picked from commit 65a08f889ff9738ddaceeeb724e6e24f3be4b2ea)