#149 Fix compute exec through the Windows PowerShell shim

Summary

• recover the compute exec command boundary when npm generated insta.ps1 consumes the bare separator
• keep CLI branch, timeout, json, and help options before the remote command
• preserve every remote argument after the recovered boundary, including flag-like values

Verification

• npm run typecheck
• 22 compute exec tests
• Windows build and PowerShell shim smoke tests for printenv PORT and a remote --json argument

Windows regression

In PowerShell, insta compute exec app -- printenv PORT resolves to the npm PowerShell shim. PowerShell removes the separator before forwarding args, so the CLI previously reported its usage error. It now restores the boundary before Commander parses argv.

---

Summary by cubic

Fixes compute exec on Windows PowerShell, where npm's generated shim consumed the bare -- separator and made the CLI show its usage error instead of running the remote command.

• On win32 the boundary is recovered before Commander parses argv: the CLI's own options are partitioned out wherever they appear, and everything else is untouched payload that resolveExecFallback splits into an optional service and the command using the service list.
• The payload's interior is never inspected, so the remote command keeps its own flags and --; --help is this command's only when nothing precedes it, and a stranded CLI option behind a real service is reported rather than run.
• Other platforms still require the explicit --; a surviving -- is the separator only at the payload's first or second token, and a flag-position matrix asserts win32 and POSIX agree exactly when the separator is intact.
• Ambiguous readings are stated on stderr without echoing the command (remote argv may carry secrets), naming insta.cmd as the escape hatch since a plain -- would be eaten again.
• Only splits when compute exec is this process's command path, so words passed as data to another command (e.g. insta run -- compute exec app echo) are left alone.