refactor: migrate all subprocess call sites to the shared subprocess module

[iankhou]

Note

This re-submits #1758, which was merged and then reverted in #1774 because it wasn't ready yet. The branch has been updated with the latest main.

Summary

Follow-up to #1763, which adds the @aws-cdk/private-tools/lib/subprocess module.

This PR migrates every child_process call site in the shipped packages onto the shared module, so that no code path both escapes and executes:

Call site	Before	After
init/os.ts, init/init.ts	spawn(argv, {shell: true}) + broken hand-rolled escaping	run() — no shell, inherit-stderr keeps npm/pip progress bars
telemetry/library-version.ts	exec() string	run() argv
toolkit-lib ec2-detection.ts	execSync with 2>nul	runSync(), stderr discarded via stdio
toolkit-lib cloud-assembly/exec.ts (synth app)	spawn(str, {shell: true}) + split2	runUserCommandLine(), line-buffered, collect: false
commands/docs.ts (--browser)	exec()	runUserCommandLine()
cdk-assets-lib shell.ts	own spawn + broken escaping copy	delegates to run(); spawn failures rethrow the OS error so docker's ENOENT → 'please install docker' guidance is preserved
toolkit-lib environment.ts	quoteSpaces() (space-only quoting)	allowlist-based quoteShellPart()

The deleted windowsEscape helpers carried an escaping bug (shellMeta.has(x) instead of has(c)) that made Windows escaping a silent no-op — this PR removes the pattern rather than fixing it. grep -rn runUserCommandLine now returns exactly the two sinks where a shell is the documented contract (synth app, --browser) — the complete trust-model surface.

Drops split2 from toolkit-lib (replaced by the module's line buffering).

Not in scope (follow-ups): cdk-build-tools/integ-runner/cli-integ migration, the eslint no-restricted-imports ban on child_process, and a Windows CI leg for the module.

Checklist

• Unit tests added/updated
• Manually verified: init (git/npm/metachar paths), synth (shell features, exit codes, 200k-line streaming, UTF-8), docs --browser, cdk-assets shell paths (hostile args, docker ENOENT, EPIPE)
• No manual edits to generated files

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

packages/@aws-cdk/cdk-assets-lib/package.json

Package	Version	License	Issue Type
cross-spawn	^7.0.6	Null	Unknown License

packages/@aws-cdk/toolkit-lib/package.json

Package	Version	License	Issue Type
cross-spawn	^7.0.6	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/cross-spawn	^7.0.6	Unknown	Unknown
npm/cross-spawn	^7.0.6	Unknown	Unknown

Scanned Files

• packages/@aws-cdk/cdk-assets-lib/package.json
• packages/@aws-cdk/toolkit-lib/package.json
• yarn.lock