runTest.js triggers Node DEP0190 by passing args with shell: true

Environment

• Windows 11
• Node.js v26.5.0
• @vscode/test-electron 2.5.2 (via @vscode/test-cli 0.0.10)

Problem

Every vscode-test run prints a Node deprecation warning before anything else:

(node:5828) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)

Cause

out/runTest.js:

async function innerRunTests(executable, args, testRunnerEnv) {
    const fullEnv = Object.assign({}, process.env, testRunnerEnv);
    const shell = process.platform === 'win32';
    const cmd = cp.spawn(shell ? `"${executable}"` : executable, args, { env: fullEnv, shell });

Passing a non-empty args array together with shell: true is exactly the pattern Node deprecates as DEP0190.

Suggestion

Spawn without a shell (resolve the actual .exe / .cmd and pass args directly), or otherwise escape/concatenate the arguments explicitly. On Windows the arguments here include paths that may contain spaces (--extensionDevelopmentPath=..., --user-data-dir=...), so dropping shell: true and quoting is the safer route.

This may also be related to #361: in both cases the spawned CLI process does not behave as expected on Windows when it lives on a different drive than the profile directories.

Start with out/runTest.js, especially innerRunTests and its child-process spawn call, then reproduce a vscode-test run on Windows with arguments containing paths. Compare the available process-launch behavior and verify that the completed change no longer emits DEP0190 while still handling executable and profile paths on different drives.