fix: normalize Windows exec allowlist paths

src/infra/exec-approvals.ts

@@ -409,6 +409,10 @@ export function resolveCommandResolutionFromArgv(
 }
 
 function normalizeMatchTarget(value: string): string {
+  if (process.platform === "win32") {
+    const stripped = value.replace(/^\\\\[?.]\\/, "");
+    return stripped.replace(/\\/g, "/").toLowerCase();
+  }
   return value.replace(/\\\\/g, "/").toLowerCase();
 }