fix: harden native Windows runtime

[sethkarten]

Summary

This draft hardens native Windows support after #1982. It keeps Git Bash as the default shell and does not use WSL.

• prevents background daemon, worker, catalog, and update processes from flashing console windows
• gives slow Windows worker launches a bounded 90-second supervisor handshake and a 120-second client create timeout
• makes settings, session leases, kernel bootstrap locks, and RLM display tombstones survive common Windows sharing violations
• keeps RLM deletion durable and retryable without duplicate terminal notices or late state resurrection
• executes .cmd and .bat shims through a controlled cmd.exe command string with exact metacharacter tests
• forces UTF-8 mode for the persistent CPython process on Windows and keeps CPython 3.11
• selects only canonical Git for Windows installs by default; nonstandard installs require shellPath
• adds Windows named-pipe support for Herdr, BOM-tolerant frontmatter, native tilde path handling, and raw multiline paste handling
• gives persisted sessions an owned scratch directory through PRIME_AGENT_SESSION_TMP, TMP, TEMP, and TMPDIR

Safety boundaries

• no WSL, Cygwin, or MSYS2 fallback from PATH
• no shell: true
• no guessed cleanup of user files
• no IPython, Jupyter, ZeroMQ, or ipykernel
• foreground interactive consoles remain visible
• macOS and Linux keep their existing worker deadline and retry cadence

Local validation

• ~/.bun/bin/bun run check
• 208 Windows-hardening behavior tests in the CI test set: 208 passed, 2 Windows-only tests skipped locally
• focused RLM lifecycle set: 4 passed
• full RLM/display/daemon set: 306 passed
• daemon named-pipe lifecycle and batch-shim set: 3 passed, 1 Windows-only test skipped locally
• settings: 45 passed
• session leases and recovery journal: 24 passed
• terminal input: 67 passed
• real persistent CPython/ACP kernel: 4 passed
• git diff --check

Native Windows validation

Final run: https://github.com/PrimeIntellect-ai/prime-agent/actions/runs/33650350794

• all 14 PR checks passed
• Windows behavior: 200 passed, 6 platform-specific skips, 0 failed across 19 files
• RLM deletion/finalization races: 4 passed
• real supervisor-to-worker named-pipe lifecycle: passed in 8.15 seconds
• terminal/TUI: 224 passed
• persistent CPython at D:\a\_temp\Prime Agent ø\kernel-venv: 19 passed, 2 skipped
• Win32 job and interrupt runtime: 25 ran, 1 expected skip, result OK
• x64 executable PE machine: 0x8664
• Arm64 executable PE machine: 0xAA64
• PowerShell installer install, version 0.9.1, update, and uninstall: passed
• compiled pi.exe --version (0.9.1) and pi.exe --help: passed

Stack

Base: feat/windows-support from #1982. This PR does not modify #1982 and should be reviewed after it.

Note

Harden Windows runtime for bootstrap locks, shell resolution, leases, and atomic file writes

• Rewrites acquireBootstrapLock to claim the lock via atomic candidate-directory rename, reclaim stale locks safely, and retry bounded Windows release failures; adds a proper-lockfile guard around lock updates
• Restricts getShellConfig on Windows to the two canonical Git for Windows paths, rejecting PATH-discovered Cygwin/MSYS2/WSL shells with install guidance
• Reworks session lease acquisition in acquireSessionLease to classify rename contention per-platform, reject live owners, retry stale-target races, and quarantine-then-delete stale lease directories
• Adds bounded Windows rename retries for RLM display entry writes and settings file writes; both now use UUID-suffixed temp files, preserve POSIX permissions, and respect deletion tombstones
• Launches all daemon and worker child processes on Windows with windowsHide; bootstrap subprocesses get PYTHONUTF8=1 and .cmd/.bat files go through a validated cmd.exe shim
• Adds TUI raw multiline paste detection in StdinBuffer.process and strips leading UTF-8 BOM in normalizeNewlines
• Risk: readLeaseOwner now throws on corrupt or inaccessible owner metadata instead of treating it as unowned; getShellConfig on Windows no longer falls back to PATH bash, so environments without canonical Git Bash will fail

^{Macroscope summarized 6e85243. (Automatic summaries will resume when PR exits draft mode or review begins).}