fix: workflow reactions, Windows Claude shim, oversized frames

[Chessing234]

Summary

• Route workflow add_reaction through ActionSink (kind:7) instead of the missing HTTP route (workflow: add_reaction action calls a nonexistent relay endpoint — any workflow using it always fails #2395)
• On Windows, skip .cmd/.bat for CLAUDE_CODE_EXECUTABLE so Claude turns don't fail with spawn EINVAL ([Bug] windows: claude runtime turns fail with spawn EINVAL (CLAUDE_CODE_EXECUTABLE set to a .cmd shim) #2397)
• Remember the relay frame-size limit from NOTICE and refuse to resend oversized payloads (Desktop blind-retries an oversized (~66KB) frame on join — reconnect storm against relays with the 64KB limit #2471)

Test plan

• Workflow with add_reaction step completes and stores a kind:7
• Windows: Claude agent turns succeed when only claude.cmd is on PATH
• Against a 64KB-limit relay, an oversized send disconnects once and does not reconnect-storm

Made with Cursor

[Chessing234]

@tlongwell-block @wesbillman @wpfleger96 mind taking a look when you get a chance?

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 114dbf745f1fe0bdbecb70e07a07f03c23687bdc...d6e1437e91defbb25c519fe441699bbc27ad9268.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review d6e1437e91defbb25c519fe441699bbc27ad9268 to authorize a new review.
Any previous review applies only to its recorded range.