feat(claude-bin): Bun.which wrapper for cross-platform claude resolution

Replaces 75 LOC of fork-side reimplementation (PATH parsing, Windows PATHEXT,
case-insensitive Path/PATH, X_OK) with a thin wrapper around Bun.which() — the
runtime built-in that already does all of it. New file is ~70 LOC including
the override + arg-prefix logic the runtime doesn't cover.

Override branch fixed: GSTACK_CLAUDE_BIN=wsl now resolves through Bun.which()
just like a bare claude lookup would. The McGluut fork's claude-bin.ts only
handled absolute-path overrides; bare commands silently returned null. Passing
the override value through Bun.which fixes the documented use case for free.

Five hardcoded claude spawn sites rewired through resolveClaudeCommand:
  - browse/src/security-classifier.ts:396 — version probe
  - browse/src/security-classifier.ts:496 — Haiku transcript classifier
  - scripts/preflight-agent-sdk.ts — preflight binary pinning
  - test/helpers/providers/claude.ts — LLM judge availability + run
  - test/helpers/agent-sdk-runner.ts — SDK harness binary resolver
All retain their existing degrade-on-missing semantics.

Tests: browse/test/claude-bin.test.ts has 9 unit tests including the
override-PATH-resolution case the fork's version got wrong.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/preflight-agent-sdk.ts

@@ -18,7 +18,7 @@
 
 import { query, type SDKMessage } from '@anthropic-ai/claude-agent-sdk';
 import { readOverlay } from './resolvers/model-overlay';
-import { execSync } from 'child_process';
+import { resolveClaudeBinary } from '../browse/src/claude-bin';
 
 async function main() {
   const failures: string[] = [];
@@ -44,12 +44,11 @@ async function main() {
 
   // 2. Local claude binary exists
   console.log('\n2. Binary pinning');
-  let claudePath: string | null = null;
-  try {
-    claudePath = execSync('which claude', { encoding: 'utf-8' }).trim();
+  let claudePath: string | null = resolveClaudeBinary();
+  if (claudePath) {
     pass(`local claude binary: ${claudePath}`);
-  } catch {
-    fail('`which claude` failed — cannot pin binary');
+  } else {
+    fail('`Bun.which("claude")` failed — cannot pin binary (set GSTACK_CLAUDE_BIN to override)');
   }
 
   // 3. SDK query end-to-end