Fix: resolveSlug silently returns "unknown" on Windows

[benjaminberes-bp]

On Windows, resolveSlug() never resolves a slug. It returns the literal
"unknown", with exit code 0 and no output.

bin/gstack-slug is an extension-less bash script. spawnSync without a shell
goes through CreateProcess, which does not honour shebangs: the call fails
with ENOENT, stdout is null, the SLUG= regex does not match, and the
: "unknown" branch is taken.

// Windows, git-bash, bun 1.3.14
const { spawnSync } = require("child_process");
const r = spawnSync("C:/Users/<u>/.claude/skills/gstack/bin/gstack-slug",
                    { encoding: "utf-8" });
console.log(r.error && r.error.code, JSON.stringify(r.stdout));
// ENOENT null

Why this is worse than a wrong path

Both consumers, bin/gstack-decision-log and bin/gstack-decision-search,
then work against ~/.gstack/projects/unknown/.

• Write side: one anonymous bucket shared by every repo on the machine.
• Read side: the directory does not exist, so the search returns an empty
  list and exits 0. The session reads "no prior decisions" and re-litigates
  settled calls in good faith.

Observed on a real project: gstack-decision-search --recent 5 printed nothing
while ~/.gstack/projects/<slug>/decisions.active.json held 3930 bytes of
decisions at the correct path. The reader was simply looking elsewhere.

The : "unknown" fallback turned an exec failure into a plausible value, which
is why this went unnoticed rather than surfacing as an error.

The fix

shell: true does not work — cmd.exe has no association for an
extension-less file and yields "unknown" too. Naming the interpreter does.

• Retry via bash <script> when the direct call yields no slug. The direct call
  is still attempted first, so POSIX behaviour is unchanged. The retry is
  keyed on "no slug parsed" rather than on ENOENT specifically, so a shim that
  exits non-zero without output is covered as well. bash and not sh:
  gstack-slug uses [[ ]] and set -o pipefail.
• Warn on stderr before falling back. The fallback value is kept so no caller
  breaks, but a tooling failure is not an anonymous project.

Tests

test/bin-context-resolve-slug.test.ts pins both halves — that an
extension-less shebang script resolves on every platform, and that a failure is
audible. Verified failing against the pre-fix function and passing after it.

Notes

gitBranch() in the same file is unaffected: it spawns git, which Windows
resolves via PATHEXT. Only extension-less scripts break, so an audit could
look for other spawnSync calls targeting bin/gstack-*.

Verified on Windows 11 / git-bash / bun 1.3.14. Happy to adjust the approach if
you prefer a process.platform check over the retry-on-empty.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here