fix(skills): bootstrap npm safely on Windows

[miguel-heygen]

What

Windows composition-authoring helpers can now bootstrap their optional HyperFrames dependency instead of failing before npm starts.

Why

On CLI v0.7.56 with Windows and Node 22.11, animation-map failed with spawnSync npm.cmd EINVAL while bootstrapping @hyperframes/producer@0.7.55. The core check and render paths remained healthy; only the optional helper was blocked.

How

The animation and creative package loaders resolve npm's JavaScript CLI from npm_execpath or the npm bundled beside node.exe, then invoke it through Node with an argv array. This keeps shell disabled, preserves --ignore-scripts and temporary-prefix isolation, and leaves non-Windows npm execution unchanged.

Test plan

• Unit tests added/updated
• Manual safe npm-cli spawn performed
• Documentation updated (not applicable)

---