Follow up directory-scoped approvals for Windows shells

[Aaronontheweb]

Summary

PR #896 adds directory-scoped shell approval patterns, but its command parsing and path-aware verb logic are Unix-first. We should follow up with Windows-native support rather than quietly treating it as covered.

Scope

• define Windows support expectations for directory-scoped approvals
• add native verb/cmdlet coverage for cmd.exe and/or PowerShell
• support Windows-specific path-bearing argument forms such as -Path / -LiteralPath
• document behavior for Windows path normalization and matching
• add regression tests for drive-letter and UNC paths under Windows-native commands

Non-goals

• do not broaden PR feat: directory-scoped shell command approval patterns #896 beyond its current non-Windows fixes
• do not infer paths indirectly through PowerShell object pipelines in the first pass unless explicitly designed

Context

PR #896 currently:

• executes cmd.exe /c on Windows
• recognizes Windows-style paths in normalization/matching
• does not parse PowerShell cmdlets or Windows-native shell verbs comprehensively

Tracked as follow-up to PR #896.