Fix Windows sign-in: don't launch the browser through cmd.exe (v1.0.1)

cmd's `start` splits unquoted commands at "&", truncating the OAuth authorize
URL after the first query parameter — Windows users hit AADSTS900144 (missing
'scope'). Launch via rundll32 url.dll,FileProtocolHandler instead, which takes
the URL as a plain argument with no shell parsing.

Same fix as claude-msplanner b07a241, applied to the canonical skill copy and
synced into the extension bundle.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/skills/ms-todo/scripts/lib/graph.mjs

@@ -620,14 +620,23 @@ function startRedirectServer(expectedState, timeoutMs, listenPort = 0) {
 
 /** Best-effort open of a URL in the system browser (macOS / Windows / Linux). */
 function openBrowser(url) {
-  const cmd =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
-    const child = spawn(cmd, process.platform === "win32" ? ["", url] : [url], {
-      stdio: "ignore",
-      detached: true,
-      shell: process.platform === "win32",
-    });
+    let child;
+    if (process.platform === "win32") {
+      // Never route the URL through cmd.exe (`start`): cmd splits unquoted
+      // commands at "&", which truncates the authorize URL after the first
+      // query parameter (the user then sees AADSTS900144: missing 'scope').
+      // rundll32 opens the default browser with the URL as a plain argument.
+      child = spawn("rundll32", ["url.dll,FileProtocolHandler", url], {
+        stdio: "ignore",
+        detached: true,
+      });
+    } else {
+      child = spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], {
+        stdio: "ignore",
+        detached: true,
+      });
+    }
     child.on("error", () => {}); // ignore; the CLI also prints the URL as a fallback
     child.unref();
   } catch {