test(coverage): cover update-manifest else-branch + windows-shims extension + c8-ignore unreachable defenses

Three small coverage moves:

1. `windows-shims.test.mts`: the existing test for the "has extension"
   early-return (line 38-39 of windows-shims.mts) passed a Windows-
   style path `C:\nodejs\npm.exe` which `path.isAbsolute()` rejects on
   POSIX runners, so the test was hitting the not-absolute branch
   instead. Use an absolute POSIX-form path with .exe extension to
   actually reach the extname branch.

2. `update-manifest-by-agent.test.mts`: new test for the `pnpm:
   <non-object>` + empty-overrides combination (lines 135-138 of
   update-manifest-by-agent.mts) — drops the whole pnpm field by
   setting it to undefined.

3. `c8 ignore` annotations on two defensive branches that are
   unreachable in practice:
   - `socket/package-alert.mts:531-534` — `hiddenAlerts.length <
     neededCount` is impossible while `MIN_ABOVE_THE_FOLD_ALERT_COUNT
     = 1` and the map only stores entries with length >= 1.
   - `scan/handle-create-new-scan.mts:211-214` — the empty-targets
     guard runs after `applyFullExcludePaths({ target: targets[0]! })`
     which crashes first on empty input.

Coverage: 92.84% → 92.86% statements.

Author: jdalton