Refactor: Replace shell-string CLI launching with arg-array pattern

Description

runWinappCommand() in extension.ts launches CLI commands via PowerShell string concatenation (terminal.sendText(& ${escapePowerShellArg(cliPath)} ${command})), while other paths in the same file already use the safer spawn(cliPath, args, { shell: false }) pattern.

Impact

• Inconsistent CLI launch patterns within the same file
• Shell string approach is harder to audit for injection safety
• The arg-array pattern is already proven to work in the debug adapter and cert flows

Location

src/extension.ts:58-72 and callers throughout the file

Recommendation

Replace the string-based runWinappCommand() API with a helper that accepts string[] args and launches the CLI with spawn/execFile. If terminal visibility is required, build a terminal-specific adapter from the same arg array.

Found by

PR review skill (alternative-solution dimension) during PR #68 review.