fix(lambda-nodejs): local bundling fails under AllSigned PowerShell execution policy

[vishwakt]

Issue # (if applicable)

Closes #38439.

Reason for this change

Local bundling on Windows runs powershell.exe -NoProfile -Command "& 'npm' 'ci'". Because the call operator receives a bare command name, PowerShell's command discovery can select the npm.ps1 shim over npm.cmd, and .ps1 scripts are subject to the execution policy. Under AllSigned there is no developer-side workaround: MachinePolicy scope overrides the Process scope that -ExecutionPolicy Bypass would set.

Description of changes

Resolve the executable with Get-Command <name> -CommandType Application before invoking it. Application matches only external programs (.cmd, .exe), so the .ps1 shim is never a candidate.

Both prior fixes are preserved: the command name and all arguments are still individually quoted via powershellEscape (command injection fix), and spawn steps still route through PowerShell rather than spawning .cmd directly (EINVAL fix from #37412).

Behavior note: a missing executable now surfaces as PowerShell's CommandNotFoundException instead of a spawn failure. The message still names the command.

Describe any new or updated permissions being added

None.

Description of how you validated changes

The existing Windows spawn test now also asserts the resolved-application form, and a new test over a nodeModules install asserts every spawn resolves its executable, none uses the bare & '...' form, and the npm ci step is present. Both assertions fail against the current implementation and pass with the fix. Full aws-lambda-nodejs suite passes (154 tests); docker.test.ts was not run as it requires a Docker daemon.

I do not have a Windows machine with MachinePolicy: AllSigned, so the fix is verified by asserting the generated command line rather than by executing it. @jeham, if you are able to confirm on your environment that would be valuable.

No integration test: local bundling path, no template or deployable behavior change. Exemption Request will follow if the linter requires one.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[vishwakt]

Exemption Request for the integration test requirement.

This changes only the PowerShell command line used by the local bundling spawn path on Windows. There is no CloudFormation template change, no new resource types or properties, and nothing deployable for an integration test to exercise. Coverage is by unit tests asserting the generated command line, both of which fail against the previous implementation. The local bundling path this touches has no integration test coverage today.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.