test-recorder: runCommand loses output types and mangles %VAR% args on Windows

## Problem / Goal

Follow-up from https://github.com/Comfy-Org/ComfyUI_frontend/pull/15537#discussion_r3834620423 (CodeRabbit finding, deferred as Windows-only and untestable locally).

Two defects in `tools/test-recorder/src/cli/run.ts`:

1. `runCommand` accepts string encodings but always returns `SpawnSyncReturns` via type assertion (lines 17-33), so string-output callers get lying types.
2. With `shell: true`, cmd.exe expands `%NAME%` after `quoteForCmd`, so literal percent arguments like `%USERNAME%` are corrupted on native Windows.

Both are pre-existing on the branch, not introduced by the review round that flagged them.

## Proposed Solution

- Add overloads matching spawnSync's contract: string encoding → `SpawnSyncReturns`, buffer/unspecified → `SpawnSyncReturns`.
- Use a launch path that preserves arbitrary arguments while still supporting `pnpm.cmd` (avoid post-quoting cmd.exe expansion).

## Acceptance Criteria

- [ ] Regression tests for both string and buffer output paths
- [ ] Native-Windows coverage for percent signs, quotes, and metacharacters in arguments
- [ ] Fix verified on Windows CI, not just locally