fix(acpx): share windows wrapper resolver and add strict hardening mode

extensions/acpx/src/config.test.ts

@@ -20,6 +20,7 @@ describe("acpx plugin config parsing", () => {
     expect(resolved.expectedVersion).toBe(ACPX_PINNED_VERSION);
     expect(resolved.allowPluginLocalInstall).toBe(true);
     expect(resolved.cwd).toBe(path.resolve("/tmp/workspace"));
+    expect(resolved.strictWindowsCmdWrapper).toBe(false);
   });
 
   it("accepts command override and disables plugin-local auto-install", () => {
@@ -109,4 +110,26 @@ describe("acpx plugin config parsing", () => {
 
     expect(parsed.success).toBe(false);
   });
+
+  it("accepts strictWindowsCmdWrapper override", () => {
+    const resolved = resolveAcpxPluginConfig({
+      rawConfig: {
+        strictWindowsCmdWrapper: true,
+      },
+      workspaceDir: "/tmp/workspace",
+    });
+
+    expect(resolved.strictWindowsCmdWrapper).toBe(true);
+  });
+
+  it("rejects non-boolean strictWindowsCmdWrapper", () => {
+    expect(() =>
+      resolveAcpxPluginConfig({
+        rawConfig: {
+          strictWindowsCmdWrapper: "yes",
+        },
+        workspaceDir: "/tmp/workspace",
+      }),
+    ).toThrow("strictWindowsCmdWrapper must be a boolean");
+  });
 });