readProfileCredentials now checks for a credential_process key after
the static-keys and SSO branches. The helper is spawned via Bun.spawn
with stdin ignored; stdout is parsed as the AWS SDK Version 1 JSON
envelope; Expiration feeds the existing per-profile cache so re-invocations
honour the broker's TTL.
Additional coverage:
- POSIX-shell tokenizer preserves backslashes inside double quotes so
Windows paths like "C:\\Program Files\\auth.exe" tokenize correctly.
- .cmd/.bat helpers are routed through cmd.exe /c on Windows.
- AbortSignal is forwarded to the child process.
- 13 new tests covering tokenizer edge cases, envelope validation,
cache hit-count, non-zero exit stderr surfacing, and abort propagation.
Fixes#1142
roboomp
fa83ebcb45