fix(phase4): use bundled node for Windows version probe (#83)

The Windows acceptance lane installs and runs 1Helm successfully, but its version assertion called bare node even though the Linux host contract keeps Node at /opt/1helm/node-current/bin/node. Use that stable bundled path and lock it into the Phase 4 regression contract.

Co-authored-by: Joseph Yaksich <gitcommit90@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: gitcommit90

ops/platform-acceptance/windows.ps1

@@ -52,9 +52,12 @@ function Assert-DistroVersion([string] $ExpectedVersion) {
     # which ended the PowerShell string and executed `systemctl` on Windows.
     # Substitute only the already-validated semver after constructing the exact
     # bash command, so every service/version assertion really runs inside WSL.
+    # 1Helm bundles its own Node at the installed /opt/1helm/node-current
+    # contract path; there is no global `node` on the distro PATH, so invoke
+    # the bundled binary by absolute path.
     $command = @'
 test "$(systemctl is-active 1helm.service)" = active
-test "$(node -p 'require("/opt/1helm/current/package.json").version')" = '__EXPECTED__'
+test "$(/opt/1helm/node-current/bin/node -p 'require("/opt/1helm/current/package.json").version')" = '__EXPECTED__'
 '@
     Invoke-Distro ($command.Replace('__EXPECTED__', $ExpectedVersion))
 }

test/phase4-platform-acceptance.mjs

@@ -212,6 +212,7 @@ test("Windows code publishes no artifact/signing claim and requires honest reboo
   assert.match(windows, /apply-linux-release\.sh/);
   assert.match(windows, /function Assert-DistroVersion/);
   assert.equal((windows.match(/Assert-DistroVersion \$(?:Version|PreviousVersion)/g) || []).length, 4);
+  assert.match(windows, /\/opt\/1helm\/node-current\/bin\/node/);
   assert.match(windows, /UTF8Encoding\(\$false\)/);
   assert.match(windows, /\[IO\.File\]::WriteAllText/);
   assert.match(windows, /\/bin\/bash -lc "bash '\$scriptInDistro'"/);