fix(scanner): support Windows cmd shims for ast-grep (npm installs)

[kyooosukedn]

What does this PR do?

On Windows, npm install -g @ast-grep/cli (the easiest install route — brew/cargo/pipx are not the Windows defaults) ships ast-grep.cmd / sg.cmd shims instead of real executables. Go's exec cannot run .cmd files directly, so findAstGrepBinary rejected a working ast-grep and --deps / --importers failed with ast-grep not found (checked bundled tools and PATH) even though ast-grep was on PATH.

Reproduction (Windows 11, codemap 4.4.0):

npm install -g @ast-grep/cli
codemap --deps .        # → Error: ast-grep not found

Three changes:

1. astGrepCommand wraps .cmd/.bat invocation in cmd.exe /c so version checks and scans can execute shims at all.
2. File-based rules for shim scans: cmd.exe cannot reliably carry the multi-line --inline-rules argument (quoting + line-length limits mangle it), so shim scans materialize the embedded rules into a temp dir and pass a short --config path instead. Two gotchas encoded in the helper:
   • ast-grep ignores ruleDirs pointing at the directory that contains sgconfig.yml itself (ruleDirs: ["."]" is a no-op), so rules go into a rules/` subdirectory with a generated config.
   • the rules dir is created once per scanner (mutex-guarded) and removed in Close().
3. Windows-gated regression tests: version-check detection through a fake .cmd shim, and a full ScanDirectory through one.

Type of change

• Bug fix
• New feature
• New language support
• Documentation
• Other (describe below)

Checklist

• I've tested this locally with go build && ./codemap . — built from this branch, with only the npm .cmd shim on PATH: --deps . on a mixed Expo/TS + Java repo now produces the full dependency flow (was: ast-grep not found). TestAstGrepAnalyzer and TestAstGrepPython now pass on Windows with the npm shim (they previously failed on main in this environment).
• I've read CONTRIBUTING.md (for new language support)
• I've updated documentation if needed

Additional notes

• Blast-radius tests in the root package (TestBlastRadius*) fail on unmodified main on Windows as well — they build an extensionless codemap_test_binary that Windows cannot execute. Pre-existing and unrelated to this change; happy to look at it in a follow-up if useful.
• Separate observation, not addressed here: --importers app/src/lib/typing.ts reported no importers although grep confirms 4 files import it in my test repo. Looks like a resolver-mapping issue independent of the shim path.