feat(local): add --verify, --timeout, auto-detect dev script, post-init verification - #998

When process.env.PATH is undefined, `${binDir}${sep}${env.PATH ?? ""}` produces a trailing : on Unix, which POSIX treats as the current working directory — any executable (e.g. node, python) placed in the project root will shadow the system binary for the spawned child process. Fix: env.PATH ? \${binDir}${sep}${env.PATH}` : binDir`.

The regex does not include the backtick character, so a package.json script using backtick command substitution (e.g. "dev": "node \which webpack` serve") bypasses the shell-detection path and is split by whitespace into broken args like ["node", "`which", "webpack`", "serve"], causing the spawn to fail silently instead of wrapping the value in sh -c`.

In src/lib/dev-script.ts tryPackageJson, after the guard value.trim().length > 0 passes, the value is split with value.split(/\s+/) without trimming first. A script value with leading or trailing whitespace (e.g. " npm run dev ") produces ["", "npm", "run", "dev", ""], where the first element is an empty string. This array is then passed to Bun.spawn in both src/commands/local/run.ts (lines 234/344) and src/lib/init/verify-setup.ts (line 86). With "" as the executable, the spawn will fail; in run.ts this surfaces as a CliError, and in verify-setup.ts the catch block silently skips post-init verification. Fix by trimming before splitting: value.trim().split(WHITESPACE_RE).