Conflicts resolved toward the PM model: main's lazy_deps/update_cmd_deps/npm
stamp machinery stays deleted (PM + scripts/build/node-deps.mjs own it), the
systemd ExecStop stop-mark rides the installation launcher, legacy
linux_only/macos_only/windows_only markers are rewritten to platforms(), and
finalize_update_receipt carries pending manual-serve obligations forward
again (lost when the ContextVar receipt rewrite crossed c0aa3ce354).
Test harness: the real-home I/O guard exempts /proc/<pid>/fd metadata reads
(deleted-WAL holder scans) and run_tests.sh drops ~/.hermes PATH entries so
shutil.which() cannot trip the tripwire.
Review follow-up on the Windows .cmd fix: the only always-on test drove the
`_native_binary_candidates` helper directly, so reverting the production wiring
(`_existing_binary` probing npm's bin dir, wrapper-first order, `_spawn_pyright`
keeping the resolved suffix) stayed green on every non-Windows lane.
`is_windows` is now threaded as data through `_first_existing`/`_existing_binary`
(no sys.platform patch), and the test drives the production entry over an npm-shaped
staging tree (POSIX shim + `.cmd` pair under `lsp/node_modules/.bin`) and asserts
`_spawn_pyright` picks `pyright-langserver.cmd` when handed `pyright.cmd`. Each of
the three wiring reverts turns it red; the windows_only live test stays as-is.
npm writes a POSIX `#!/bin/sh` shim under the bare binary name next to its
`.cmd` wrapper. `_native_binary_candidates` listed the bare name first and
`os.access(X_OK)` is always true on Windows, so `_existing_binary` handed the
shell script to CreateProcess (WinError 193) and `_install_npm` staged the
shim instead of the wrapper. Python/TS/YAML diagnostics were silently gone
for the whole session on native Windows.
- wrappers first, bare name last; the ordering takes `is_windows` as data so
the invariant is testable on every host
- npm's `%~dp0`-relative `.cmd`/`.bat` wrappers stay in `node_modules/.bin`
(a copy in `lsp/bin/` points at nothing); `_existing_binary` probes there
- PATH probing tries the wrappers before the bare name too
- pyright: the langserver sibling keeps the resolved binary's suffix
Salvages #73088 by @BrierAinz (same diagnosis and staging fix, rebuilt on
the current install.py shape).
