Bookmarks with shell glob patterns fail — spawnShellCommand uses /bin/sh instead of user's shell

Bookmark commands that contain shell-specific glob or expansion syntax fail at runtime because spawnShellCommand uses /bin/sh (POSIX sh) via Node.js spawnSync(..., { shell: true }).

POSIX sh doesn't support:

Extended glob alternation: (a|b|c) (zsh)
Brace expansion: {a,b,c} (bash/zsh)
This means the :or and :brace array render modes in wildcards produce output that can never actually execute successfully.

Repro

```
scriptpal bookmark add demo 'echo packages/(foo|bar|baz)'
scriptpal bookmark run demo
# /bin/sh: -c: line 0: syntax error near unexpected token `|'
```

Or using the :or wildcard renderer:

```
scriptpal bookmark add typecheck 'yarn typecheck:package packages/${pkg:array:or}'
scriptpal bookmark run typecheck pkg=foo,bar
# /bin/sh: -c: line 0: syntax error near unexpected token `|'
```

Root cause
```
// index.js line 53-54
function spawnShellCommand(command) {
const result = spawnSync(command, { stdio: "inherit", shell: true });
```

When shell: true, Node.js defaults to /bin/sh on Unix. /bin/sh is POSIX-only and rejects the syntax that :or and :brace renderers produce.

Proposed fix
Use the user's login shell ($SHELL) instead of the default:

```
function spawnShellCommand(command) {
const result = spawnSync(command, {
stdio: "inherit",
shell: process.env.SHELL || true,
});
```

When the shell option is a string, Node.js uses that binary. This means:

zsh users get (a|b) extended glob support
bash users get {a,b} brace expansion support
Falls back to the default /bin/sh if $SHELL is unset