fix: detect Supabase CLI invocation method

[Nexlu1]

Summary

Make Supabase CLI guidance account for how the CLI is actually installed before presenting paste-ready commands.

• detect whether the CLI is available globally or through a project package runner
• use the package runner invocation when the CLI is project-installed
• mention Windows executable forms such as npx.cmd when appropriate
• pin the CLI version for production/mutable package-runner operations
• validate the exact invocation with --help
• prefer paste-safe single-line PowerShell when practical

Closes #581.

Verification

• pnpm test — 7 passed, 0 failed
• git diff --check

Tested with Node v22.23.2 and pnpm 10.33.0 on Windows.