fix(wsl): provide xdg-open so browser-based logins work

WSL has no xdg-open and no Linux browser, so anything that shells out to one
fails with:

  exec: "xdg-open,x-www-browser,www-browser": executable file not found in $PATH

kubelogin's interactive login hits this, which matters because interactive is
the mode the shared cluster kubeconfig uses and the mode documented for
re-authenticating after a PIM activation.

Ships an xdg-open on PATH that hands the URL to Windows via powershell.exe,
falling back to explorer.exe, and points $BROWSER at it for tools that read the
variable instead of calling xdg-open. wslu would be the conventional answer but
has been removed from nixpkgs after upstream archived the project.

users/emmathorpe/work.nix

@@ -47,7 +47,23 @@
     pkgs.terraform-docs # generate Terraform module docs
     pkgs.yq-go # jq for YAML
     pkgs.gcx # Grafana Cloud CLI (dashboards, SLOs, synthetics, alerts)
+
+    # WSL ships no xdg-open, so anything that shells out to a browser dies with
+    # `exec: "xdg-open,x-www-browser,www-browser": executable file not found`.
+    # kubelogin's interactive login is the one that bites: it is the login mode
+    # the shared cluster kubeconfig uses. Hand the URL to Windows instead.
+    # (wslu, the usual answer, is gone from nixpkgs -- upstream archived it.)
+    (pkgs.writeShellScriptBin "xdg-open" ''
+      url="$1"
+      if command -v powershell.exe >/dev/null 2>&1; then
+        exec powershell.exe -NoProfile -Command "Start-Process '$url'"
+      fi
+      exec explorer.exe "$url"
+    '')
   ];
+
+  # Honoured by tools that read $BROWSER rather than calling xdg-open.
+  home.sessionVariables.BROWSER = "xdg-open";
   services.ssh-agent.enable = true;
 
   # Colourised kubectl. enableAlias points `kubectl` at kubecolor, which parses