fix: extension bootstrap path mismatch in launchExtension() (#2890)

[polajenko]

Summary

Extensions fail to load on both macOS and Windows because the forked child process's security check in index.js expects the bootstrap path under dirname(process.execPath) (the SEA binary directory), but app.js passes a path from the pkg cache (universal/<ver>/preloads/).

This affects all extensions — both user-level and project-level — on CLI v1.0.34 and v1.0.35.

Fixes #2890

Root Cause

	macOS	Windows (npm)
SEA dir (index.js)	darwin-arm64/<ver>/	npm/.../copilot-win32-x64/
Bootstrap from (app.js)	universal/<ver>/preloads/	universal/<ver>/preloads/
preloads/ exists in SEA dir?	No	No

The security check in the embedded index.js:

var z = dirname(fileURLToPath(import.meta.url));  // SEA binary dir
var q = Q?.startsWith(resolve(z, "preloads") + sep) ? Q : undefined;
// q is always undefined → falls through → "Invalid command format"

Proposed Fixes

Option A (smallest change): In launchExtension(), resolve bootstrap path from dirname(process.execPath) instead of cliDistDir, and ship preloads/ in platform npm packages.

Option B (no package changes): Expand the index.js security check to also trust the cliDistDir pkg cache path (passed via env var from parent).

See fix-extension-bootstrap-path.md in this PR for full details and code samples.

Verification

Option A tested locally on Windows 11 (npm install, CLI 1.0.35):

1. Copied preloads/ to SEA binary directory
2. Patched minified app.js to prefer dirname(process.execPath)
3. Both user-level and project-level extensions loaded successfully