make command escaping work on windows

Windows command escaping is rather different and alas, can't rely on shelljoin . It doesn't look like there's anything in stdlib to handle it either, hence the implementation inlined herein.