Windows Agent startup crashes when PATH contains a null byte

## Summary

On Windows, an Agent task can fail before its subprocess starts because the `Path` value passed through `options.env` contains a null byte. Node.js rejects the environment value with a `TypeError`, leaving the Agent unable to run.

## Environment

- Cherry Studio 2.0.14, packaged build
- Windows 11 10.0.22631 x64
- Agent conversation
- The reported `Path` includes the Cherry Studio Toolchain `mise` shims directory

## Observed behavior

Starting an Agent task in the affected environment fails before execution with:

```text
The property 'options.env['Path']' must be a string without null bytes.
```

The source of the null byte is not yet confirmed. It may originate from the system environment, toolchain path composition, or persisted application configuration.

## Expected result

Cherry Studio should validate and safely normalize subprocess environment values before spawning an Agent runtime. An invalid segment should produce a clear recovery action instead of crashing the task before execution.

## Diagnostic evidence

- Diagnostic ID: `66674291-38d3-4d0f-8c39-51774afb3b2f`
- [Open the diagnostic report](https://api.cherry-ai.com/diagnostics/66674291-38d3-4d0f-8c39-51774afb3b2f)

The unchanged raw diagnostic bundle contains unredacted logs and remains in restricted evidence storage.

## Investigation

The diagnostic confirms the rejected `Path` value and the pre-spawn failure. It does not establish which component introduced the null byte. The exact segment must be logged only in a sanitized form so local usernames and unrelated paths are not exposed.

## Acceptance criteria

- Agent subprocess environment values are checked for null bytes before the spawn call.
- Cherry Studio either removes an invalid separator/segment safely or stops with an actionable settings or environment repair message.
- Error reporting identifies the affected variable without exposing the complete user PATH.
- Regression coverage includes a Windows PATH with a null byte and a valid PATH containing the Cherry Studio Toolchain shims directory.

Start by locating the Agent runtime's subprocess spawn call and trace how options.env is assembled on Windows. Add regression coverage for a PATH containing a null byte and for a valid PATH containing the Cherry Studio Toolchain shims directory; done means invalid values produce an actionable, sanitized result without preventing valid Agent startup.

Written by the indexing model from the issue text.