The move of hasUnsafeWindowsBatchSyntax into src/shared/windows-batch-spawn.ts
silently added `(` and `)` to the cmd.exe denylist, so every .cmd shim or
argument path containing parentheses became unspawnable across nine call sites.
Parentheses only group commands and cannot chain one without a separator the
guard already rejects, so they are dropped again.
The rejected character set is now the single source for the user-facing error
strings, and `orca account add` translates the sentinel into a real message.
Co-authored-by: Orca <help@stably.ai>