Avoid shell invocation for Windows npx

[yyzquwu]

Summary

• resolve Windows npx candidates with shutil.which instead of invoking the shell
• run both the npx --version probe and MCP Inspector launch with shell=False
• add CLI regression tests that assert Windows npx probing and mcp dev do not pass shell=True

Fixes #1257.

Validation

• .\.venv\Scripts\python -m compileall -q src tests\cli
• .\.venv\Scripts\python -m pytest tests/cli/test_utils.py -q
• .\.venv\Scripts\python -m pytest tests/cli -q
• .\.venv\Scripts\python -m ruff check src\mcp\cli\cli.py tests\cli\test_utils.py
• git diff --check
• codex review --uncommitted before commit: no actionable findings

[yyzquwu]

Closing this as a duplicate of #2524, which already fixes #1257 and has green checks. I opened this while validating the Windows shell-free path independently, but #2524 should remain the canonical PR.