Fix cross-platform Release workflow failures (Linux/Windows/macOS)

The Release workflow runs a 3-OS test/build matrix that CI (ubuntu-only,
plain npm test) never exercised, surfacing several real, distinct bugs:

- Linux Build step: better-sqlite3 11.10.0 uses raw V8/lzz-generated
  bindings that fail to compile against Electron 43's newer V8 headers
  during electron-builder's native rebuild. Bumped to 13.0.1, which is
  N-API-based (ABI-stable across Node/Electron versions) and ships
  prebuilds for every target platform, so no source compile is needed.

- macOS: node-pty's bundled spawn-helper executable (prebuilds/darwin-*)
  loses its executable bit somewhere in this repo's npm install path,
  making every pty-based test fail with "posix_spawnp failed". Added
  scripts/fix-native-permissions.js (postinstall) to chmod +x it — a no-op
  once permissions are already correct.

- macOS: the sandbox-exec profile denies all file-writes outside the
  workspace/tmp dirs but never explicitly allowed /dev/null, which git (and
  other ordinary tools) write to internally — surfaced as "fatal: could not
  open '/dev/null' ... Operation not permitted" on every git-tool test.
  Bubblewrap's Linux path already gets a working /dev via --dev /dev;
  added the equivalent explicit allows for /dev/null, /dev/zero, /dev/tty.

- Windows: command-sandbox.test.ts hardcoded POSIX path literals
  (e.g. "/home/user/project") in exact-equality assertions, but wrapCommand
  resolves paths with the real host-native path.resolve regardless of the
  simulated platform parameter — path.resolve("/home/user/project") is
  "D:\home\user\project" on Windows. Tests now build expected values via
  path.resolve() themselves instead of hardcoding POSIX literals.

- Windows: a background-task test removed another workspace's temp
  directory immediately after confirming its process was still running
  (intentionally, to prove kill-by-workspace only affects its own
  workspace) — Windows won't rmdir a directory that's still a live
  process's cwd (POSIX allows this). Now kills that leftover process
  first and retries the removal briefly to absorb the kill-to-release gap.

- resource-monitor.test.ts polled on a fixed 500ms sleep for pidusage to
  report an over-limit reading; replaced with a poll-until-true wait so a
  slower/more loaded CI runner (Windows in particular) has more room
  without weakening the assertion.

Author: voidstackloop