Fix command delivery: close dead sockets on write error, use cmd.exe for power commands

agent/client/commands_windows.go

@@ -3,9 +3,30 @@
 package client
 
 import (
+	"fmt"
 	"strings"
 )
 
+// execPowerCommand runs shutdown or reboot via cmd.exe directly (bypasses
+// PowerShell execution policy restrictions).  Returns an error if the
+// command exits non-zero.
+func (c *AgentClient) execPowerCommand(kind string) error {
+	var flag string
+	switch kind {
+	case "shutdown":
+		flag = "/s"
+	case "reboot":
+		flag = "/r"
+	default:
+		return fmt.Errorf("unknown power command: %s", kind)
+	}
+	out, err := silentCombinedOutput("cmd.exe", "/C", "shutdown", flag, "/t", "0", "/f")
+	if err != nil {
+		return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
 func (c *AgentClient) platformRecon(action, command string) (handled bool, success bool, message string) {
 	var out []byte
 	var err error