Verify native-installer fix on additional environments

[itsdestin]

Background

PR #79 shipped two related changes to desktop/src/main/prerequisite-installer.ts:

1. EINVAL-safe runCommand wrapper that auto-flips shell: true for .cmd/.bat paths on Windows (works around Node 18.20.2+ CVE-2024-27980 mitigation)
2. installClaude rewrite: replaced npm install -g @anthropic-ai/claude-code with Anthropic's native installer (claude.ai/install.{ps1,sh})

Validated before merge: typecheck clean, 881 tests pass, build produces signed installer, bootstrap scripts pre-flight read confirmed non-interactive + no admin + clean exit codes.

Not validated: end-to-end first-run flow on a clean OS. We attempted a VirtualBox + Win11 ISO test rig but got blocked by VBox's Hyper-V Platform fallback on the dev machine (5–10x slowdown, install hung at 10% for hours). Documented in docs/superpowers/investigations/2026-04-29-vbox-hyperv-conflict.md.

Filing this so the verification gaps don't get forgotten.

What needs verifying

Critical (real-user repro path)

• Clean Windows 11 with no Node, no Claude. First-run wizard advances past "Installing Claude Code" without spawn EINVAL. Native installer drops claude.exe, detectClaude finds it post-install, OAuth flow completes. (This is the literal failure mode the PR was written to fix — a friend's machine hit the original bug here.)
• Windows with an existing npm-installed claude.cmd from before this change. Existing users upgrading shouldn't regress. The runCommand wrapper should make detectClaude / detectAuth / submitApiKey work on the lingering .cmd shim too.

Important (other supported platforms)

• Clean macOS (Apple Silicon). bash -c "curl -fsSL https://claude.ai/install.sh | bash" runs the bootstrap, claude ends up on PATH, OAuth completes.
• Clean macOS (Intel). Same as above on x86_64.
• Clean Linux (Ubuntu LTS). Standard distro path.
• Clean Linux (Fedora). Different package ecosystem — confirms the bootstrap doesn't assume apt.

Edge cases

• PATH propagation failure. If the native installer succeeds but claude doesn't end up on the running Electron process's PATH, the user should see the "Quit and reopen YouCoded — the new PATH entry will be picked up on next launch" message rather than a generic failure. Easiest repro: run on a fresh Windows account where the user PATH isn't yet read into the Electron process.
• PowerShell ExecutionPolicy edge case. A corporate-managed Windows machine with ExecutionPolicy AllSigned or Restricted set at machine/group-policy level. The -ExecutionPolicy Bypass flag should override at process scope, but worth verifying.
• Corporate firewall / proxy. Some networks block claude.ai or downloads.claude.ai. Should fail with a clear error, not silently hang.
• Already-authenticated user re-running first-run. Skipping installClaude (because detectClaude reports installed) shouldn't break anything in the Detect → Install → Auth state machine.

Nice to have

• Side-by-side: native install vs the legacy ~/.claude/bin/claude.cmd from a prior npm install. What does which claude resolve to? Does the native installer add itself ahead of or behind the npm shim on PATH?

How to actually run these

See docs/local-dev-vm.md in the workspace repo for the VirtualBox-based test rig (works on machines without an active hypervisor — read the pre-flight section first). For real hardware tests, just run a debug installer from a recent CI build of master against the target machine.

Closing criteria

Critical items checked. Important items: at least one of the three "clean" platforms verified per OS family. Edge cases tracked but not strictly required for closing.