fix: spawn launcher services without implicit shell (#16093)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 19deb2d0-75af-4fcf-ac1d-a6933c00769f

scripts/dev-process-utils.mjs

@@ -15,7 +15,11 @@ export function isProcessRunning(proc) {
 }
 
 /**
- * Add spawn options needed for process-tree cleanup.
+ * Add spawn options needed for safe service launches and process-tree cleanup.
+ *
+ * Arguments must bypass shell parsing so values such as version constraints
+ * containing `<` are forwarded literally. Callers that need shell behavior
+ * must invoke the shell explicitly as the command.
  *
  * On POSIX, `detached: true` makes the spawned service the leader of a new
  * process group. Later we can signal `-pid` to terminate that whole group,
@@ -30,6 +34,7 @@ export function isProcessRunning(proc) {
 export function getProcessTreeSpawnOptions(options = {}) {
   return {
     ...options,
+    shell: false,
     detached: process.platform !== "win32",
   };
 }