fix(ci): restore dotenv trust boundary and windows npm exit handling

src/process/exec.ts

@@ -234,13 +234,11 @@ export async function runCommandWithTimeout(
     signal: NodeJS.Signals | null;
     timedOut: boolean;
     noOutputTimedOut: boolean;
-    killed: boolean;
   }): boolean =>
     usesWindowsExitCodeShim &&
     params.signal == null &&
     !params.timedOut &&
-    !params.noOutputTimedOut &&
-    !params.killed;
+    !params.noOutputTimedOut;
 
   const child = spawn(
     useCmdWrapper ? (process.env.ComSpec ?? "cmd.exe") : resolvedCommand,
@@ -364,7 +362,6 @@ export async function runCommandWithTimeout(
           signal: resolvedSignal,
           timedOut,
           noOutputTimedOut,
-          killed: child.killed,
         })
       ) {
         resolvedCode = 0;

src/process/exec.windows.test.ts

@@ -162,6 +162,26 @@ describe("windows command wrapper behavior", () => {
     }
   });
 
+  it("treats shimmed Windows commands without a reported exit code as success even when child.killed is true", async () => {
+    const platformSpy = vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+    const child = createMockChild({
+      closeCode: null,
+      exitCode: null,
+    });
+    child.killed = true;
+
+    spawnMock.mockImplementation(() => child);
+
+    try {
+      const result = await runCommandWithTimeout(["npm", "--version"], { timeoutMs: 1000 });
+      expect(result.code).toBe(0);
+      expect(result.signal).toBeNull();
+      expect(result.termination).toBe("exit");
+    } finally {
+      platformSpy.mockRestore();
+    }
+  });
+
   it("uses cmd.exe wrapper with windowsVerbatimArguments in runExec for .cmd shims", async () => {
     const platformSpy = vi.spyOn(process, "platform", "get").mockReturnValue("win32");
     const expectedComSpec = process.env.ComSpec ?? "cmd.exe";