fix(dist): hash release blobs without eol filters, run npm without shell args

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/release.ts

@@ -5,7 +5,7 @@
 // 3. stores the game files (app.asar, its unpacked natives, assets/) with a manifest.json in a
 //    parentless commit at refs/builds/v<x.y.z>, next to the tag v<x.y.z> of the source;
 // 4. pushes main, the tag and the build: installed games pick it up at their next launch.
-import { execFileSync } from 'node:child_process';
+import { execFileSync, execSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { mkdtempSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
@@ -28,7 +28,7 @@ function run(cmd: string, cmdArgs: string[], env?: NodeJS.ProcessEnv): string {
 const git = (...a: string[]): string => run('git', a);
 function npm(...a: string[]): void {
   console.log(`\n> npm ${a.join(' ')}`);
-  execFileSync('npm', a, { cwd: root, stdio: 'inherit', shell: true });
+  execSync(`npm ${a.join(' ')}`, { cwd: root, stdio: 'inherit' });
 }
 function fail(message: string): never {
   console.error(`\n✗ ${message}`);
@@ -64,8 +64,8 @@ function commitBuild(): string {
     const add = (path: string, blob: string): void => {
       run('git', ['update-index', '--add', '--cacheinfo', `100644,${blob},${path}`], env);
     };
-    for (const [i, f] of manifest.files.entries()) add(f.path, run('git', ['hash-object', '-w', '--', files[i]]));
-    const manifestBlob = execFileSync('git', ['hash-object', '-w', '--stdin'], { cwd: root, input: JSON.stringify(manifest, null, 1), encoding: 'utf8' }).trim();
+    for (const [i, f] of manifest.files.entries()) add(f.path, run('git', ['hash-object', '-w', '--no-filters', '--', files[i]]));
+    const manifestBlob = execFileSync('git', ['hash-object', '-w', '--no-filters', '--stdin'], { cwd: root, input: JSON.stringify(manifest, null, 1), encoding: 'utf8' }).trim();
     add(MANIFEST_FILE, manifestBlob);
     const tree = run('git', ['write-tree'], env);
     const size = manifest.files.reduce((s, f) => s + f.size, 0);