fix(pregate): spawn the supervised shell through lib/script-invocation (#3197 tripwire)

The supervisor now resolves bash via bashCommandInvocation, so Windows uses
Git Bash instead of a PATH bash, and an unresolvable bash reports spawn-failed.
guards.ts and lanes.ts no longer spawn bash (they run through supervise.ts),
so their KNOWN_SITES entries are removed.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

lib/pregate/supervise.ts

@@ -20,6 +20,7 @@
  */
 import { spawn, spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
+import { bashCommandInvocation } from '../script-invocation';
 
 export type ProgressAdapter = 'bun';
 export const PROGRESS_ADAPTERS: Record<ProgressAdapter, RegExp> = { bun: /(?:^|[\s;&|(])bun\s+test\b/ };
@@ -134,9 +135,15 @@ export function supervise(o: SuperviseOptions): Promise<Supervised> {
     let fd: number;
     try { fd = fs.openSync(o.log, 'a'); }
     catch (e: any) { resolve({ outcome: 'spawn-failed', exit: null, signal: null, start, end: start, lastFile: null, error: e.message, ms: 0 }); return; }
+    const inv = bashCommandInvocation(`set -o pipefail; ${o.command}`);
+    if (!inv.ok) {
+      fs.closeSync(fd);
+      resolve({ outcome: 'spawn-failed', exit: null, signal: null, start, end: start, lastFile: null, error: inv.error, ms: Date.now() - started });
+      return;
+    }
     let child: ReturnType<typeof spawn>;
     try {
-      child = spawn('bash', ['-c', `set -o pipefail; ${o.command}`], { cwd: o.cwd, env: o.env, stdio: ['ignore', fd, fd], detached: process.platform !== 'win32', windowsHide: true });
+      child = spawn(inv.cmd, inv.argv, { cwd: o.cwd, env: o.env, stdio: ['ignore', fd, fd], detached: process.platform !== 'win32', windowsHide: true });
     } catch (e: any) {
       fs.closeSync(fd);
       resolve({ outcome: 'spawn-failed', exit: null, signal: null, start, end: start, lastFile: null, error: e.message, ms: Date.now() - started });