fix(core): bypass Windows Git lookup

[opencode-agent]

Summary

• resolve Git once on Windows and pass its absolute executable path to process launches
• use native child_process.spawn for absolute .exe and .com commands without a shell
• preserve dynamic PATH resolution on non-Windows platforms
• ignore inherited stdin for repository operations that never consume it

Verification

• bun test test/git.test.ts from packages/core (5 passed)
• git diff --check

Requested by: @rekram1-node (Aiden via Slack)

[Enough1122]

AI code review — automated review for reference; please use your judgment.

• packages/core/src/git.ts:13 — which("git") executes at module-import time and freezes the result for the whole process: a git install/uninstall or PATH mutation after startup is ignored, and every consumer pays lookup cost even when snapshots/VCS are disabled — consider lazy memoized resolution inside the layer, and wrap it in try/catch so an unexpected error from which() cannot break importing the module at all.
• packages/core/src/git.ts:14 — When which() finds nothing on Windows the code silently falls back to bare "git", reintroducing exactly the lookup behavior this fix bypasses, with no signal — log a one-time warning (or record telemetry) when resolution fails so misconfigured machines are diagnosable.
• packages/util/src/cross-spawn-spawner.ts:265 — The native-spawn predicate (win32 && !shell && isAbsolute && .com/.exe) is nontrivial decision logic exercised only implicitly on Windows machines — extract it into a small pure helper (e.g., shouldSpawnNative(command, opts)) and add a unit-test matrix covering shell modes, extension casing, relative vs absolute paths, and .cmd shims so future edits can't silently regress the escape hatch.
• packages/core/src/git.ts:12 — The win32 platform check and extension allowlist are now duplicated across two packages (core/git and util/cross-spawn-spawner); a shared helper in @opencode-ai/util would keep the "what counts as a native Windows executable" rule defined in exactly one place.

— AI code review (automated)

[Enough1122]

AI code review - automated review for reference; please use your judgment.

• packages/core/src/git.ts:13-14 - git is resolved at module import time and cached forever; a user installing/repairing Git while opencode runs keeps the stale path until restart, and every process start pays a which scan even when Git features go unused. Lazy resolution on first use (memoized) would avoid both.
• packages/util/src/cross-spawn-spawner.ts:265-270 - the native-spawn guard (win32 + no shell + absolute + .exe/.com) is correctly narrow since cross-spawn still handles .cmd/.bat argument escaping; consider a comment noting why shell usage must keep using the shim (quoting rules).
• Fallback to bare "git" when which misses preserves prior behavior - good.
• No tests for the resolution logic; at least a unit test pinning the .com/.ext set behavior would help since it gates a security-sensitive spawn path.

[neriousy]

Closing in favor of #43998