Fix CodeQL relative-path-command alerts in test code

Use absolute paths for system commands (cat → /usr/bin/cat, cmd →
COMSPEC env var) and resolve npx via PATH search in CapiProxy to
avoid executing commands with relative paths.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c4e523e3-9d39-4598-90ec-54d959c44ce8

Author: edburns

java/sdk/src/test/java/com/github/copilot/CapiProxy.java

@@ -93,9 +93,10 @@ public String start() throws IOException, InterruptedException {
         // Start the harness server using npx tsx
         // On Windows, npx is installed as npx.cmd which requires cmd /c to launch
         boolean isWindows = System.getProperty("os.name").toLowerCase().contains("win");
+        String npxPath = resolveCommand(isWindows ? "npx.cmd" : "npx");
         var pb = isWindows
-                ? new ProcessBuilder("cmd", "/c", "npx", "tsx", "server.ts")
-                : new ProcessBuilder("npx", "tsx", "server.ts");
+                ? new ProcessBuilder(System.getenv("COMSPEC"), "/c", npxPath, "tsx", "server.ts")
+                : new ProcessBuilder(npxPath, "tsx", "server.ts");
         pb.directory(harnessDir.toFile());
         pb.redirectErrorStream(false);
         // Tell the replaying proxy to fail fast on unmatched requests rather than
@@ -516,6 +517,24 @@ private Path findHarnessDirectory() {
         return null;
     }
 
+    /**
+     * Resolves a command name to its absolute path by searching the system
+     * {@code PATH}. Falls back to the original name if not found.
+     */
+    private static String resolveCommand(String command) {
+        String pathEnv = System.getenv("PATH");
+        if (pathEnv == null) {
+            return command;
+        }
+        for (String dir : pathEnv.split(java.io.File.pathSeparator)) {
+            Path candidate = Path.of(dir, command);
+            if (java.nio.file.Files.isExecutable(candidate)) {
+                return candidate.toAbsolutePath().toString();
+            }
+        }
+        return command;
+    }
+
     /**
      * Test information record for configuring the proxy.
      */

java/sdk/src/test/java/com/github/copilot/CliServerManagerTest.java

@@ -72,7 +72,9 @@ void connectToServerTcpMode() throws Exception {
 
     private static Process startBlockingProcess() throws IOException {
         boolean isWindows = System.getProperty("os.name").toLowerCase().contains("windows");
-        return (isWindows ? new ProcessBuilder("cmd", "/c", "more") : new ProcessBuilder("cat")).start();
+        return (isWindows
+                ? new ProcessBuilder(System.getenv("COMSPEC"), "/c", "more")
+                : new ProcessBuilder("/usr/bin/cat")).start();
     }
 
     @Test

java/sdk/src/test/java/com/github/copilot/JsonRpcClientTest.java

@@ -135,7 +135,9 @@ void testIsConnectedWithSocketClosed() throws Exception {
 
     private static Process startBlockingProcess() throws IOException {
         boolean isWindows = System.getProperty("os.name").toLowerCase().contains("windows");
-        return (isWindows ? new ProcessBuilder("cmd", "/c", "more") : new ProcessBuilder("cat")).start();
+        return (isWindows
+                ? new ProcessBuilder(System.getenv("COMSPEC"), "/c", "more")
+                : new ProcessBuilder("/usr/bin/cat")).start();
     }
 
     @Test