[Exeloo]

What does this PR do?

Refs #123

nf now imports the local CLI's command.loader.js through pathToFileURL(...).href instead of a raw posix.join path. ESM rejects a raw C:\... path on Windows, which would break every command run inside a project that has the CLI installed locally.

nf.ts → localBinExists() → loadLocalBinCommandLoader()
                              └ import(getLocalBinCommandLoaderUrl())   // file:///C:/.../command.loader.js

Stack (all PRs target main, merge in this order): #274 → #273 → this PR. Until those merge, this PR also lists their commits.

It also adds e2e/cli-local-bin.test.ts: a project with a stub local CLI in node_modules, where nf --help must list the stub's command. On Linux the old raw-path import works too, so this test only tells the fix apart on the End-to-end tests (windows-latest) job.

This covers the code criteria of #123. The issue stays open until the Windows retest (nf new, nf build, nf start, nf dev) is done.

Merge danger

Door: two-way (revert is enough)
Blast radius: small. No runtime dependents; dev dependents in engine and examples. The CLI is a published package: it ships with the next release, nothing deploys on merge.

Follow-up issues

None

How do you test this PR?

• Before: import("C:\\...\\command.loader.js") is rejected by ESM on Windows (read from the code, not reproduced on Windows).
  After: src/lib/utils/local-binaries.spec.ts checks that C:\Users\me\my game gives file:///C:/Users/me/my%20game/node_modules/@nanoforge-dev/cli/dist/command.loader.js, plus a POSIX path.
• Commands run (Node 26.7.0, Linux): pnpm run build ✓, pnpm run lint ✓, pnpm run test:unit ✓ (262 tests); pre-push hook: repo:build, repo:lint, repo:test:unit, repo:test:e2e ✓.
• Smoke test: nf --help from a project with a local CLI installed goes through the new import and prints the usage.
• Not tested on Windows.

Quality gate

Check	Result	Notes
Docs	N/A (no command, flag, config or public API change)
Correctness	Pass	0 findings; #123 criteria 2 and 3 met, 1 and 4 (Windows retest) open
Performance	Pass	one built-in import at startup
Accessibility	N/A (no terminal output change)
Security	Pass	same fixed import path, only its encoding changes
Style	Pass	lint: pass