Login-shell invocation passes `bash -c -l <cmd>` (wrong flag order) — strict POSIX shells run `-l` as the command

## Summary

Claude Code builds its bash invocation as `bash ["-c", "-l", ]` (and the shell-snapshot login shell as `["-c", "-l", …]`). With `bash -c`, the **next argument** is the command string and any following args become `$0, $1, …`. So `bash -c -l "echo hi"` runs `-l` as the command (→ `command not found: -l`) and `echo hi` becomes `$0`.

It only "works" on shells that leniently reorder leading options; a strict/POSIX shell (e.g. the one in a hardened sandbox VM) executes `-l` literally and every bash tool call / shell snapshot fails.

The correct order is `bash -l -c ` (login shell flag first, then `-c` consumes the command).

## Repro (any POSIX bash)

```
$ bash -c -l "echo hi"
bash: line 0: -l: command not found # wrong: -l ran as the command
$ bash -l -c "echo hi"
hi # correct
```

## Where (minified symbols drift across releases; locate by behavior)

- Bash tool provider `getSpawnArgs`: returns `["-c", ...isLogin ? [] : ["-l"], cmd]` → should be `isLogin ? ["-l", "-c", cmd] : ["-c", cmd]`.
- Shell-snapshot login shell spawn: `spawn(bash, ["-c", "-l", scriptPath], …)` → `spawn(bash, ["-l", "-c", scriptPath], …)`.

## Fix

Emit `-l` **before** `-c` for login shells; for non-login, just `["-c", cmd]`.

## Impact

Any agent runtime backed by a strict POSIX shell fails every bash tool call and every shell snapshot. Downstream integrations currently carry build-time patches to reorder these args; they can be dropped once this is fixed upstream.