fix(windows-ci): configure git identity + extend Windows-fragility curation

First windows-free-tests CI run surfaced 34 failures across two patterns:

1. Tests that init a temp git repo via execSync('git commit ...') — Windows
   runner has no default git user.email/user.name, so the commit fails.
   Fix: add a "Configure git identity" step to .github/workflows/windows-free-tests.yml
   that sets a CI-only identity globally.

2. Tests that use POSIX-only APIs unconditionally:
   - file-mode bitmask checks (`stat.mode & 0o600`, `mode & 0o111`) — Windows
     fakes mode bits and these assertions don't compose
   - hardcoded forward-slash path assertions (`file.endsWith('/tab-42.json')`)
     — Windows path separators are '\\'
   Fix: extend WINDOWS_FRAGILE_PATTERNS in scripts/test-free-shards.ts to
   detect both. 8 additional tests now excluded from the curated Windows
   subset with logged reasons:
     - browse/test/security-review-flow.test.ts (file mode)
     - browse/test/security-sidepanel-dom.test.ts (forward-slash path)
     - browse/test/url-validation.test.ts (forward-slash path)
     - test/gbrain-repo-policy.test.ts (file mode)
     - test/relink.test.ts (file mode)
     - test/skill-validation.test.ts (file mode — single assertion at :934)
     - test/team-mode.test.ts (file mode — also kills its 30 git-init beforeEach failures)
     - test/upgrade-migration-v1.test.ts (file mode)

Curated Windows subset: 103 → 95 tests (still ~74% of free suite). All
14 test-free-shards unit tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/windows-free-tests.yml

@@ -37,6 +37,13 @@ jobs:
         with:
           bun-version: latest
 
+      - name: Configure git identity (required by tests that init temp repos)
+        run: |
+          git config --global user.email "windows-ci@gstack.test"
+          git config --global user.name "Windows CI"
+          git config --global init.defaultBranch main
+        shell: bash
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 

scripts/test-free-shards.ts

@@ -47,8 +47,11 @@ const PAID_EVAL_TESTS = [
 // matter how the runner shards. Codex's v1.18.0.0 review flagged the first
 // three as concrete examples in the existing free suite (test/ship-version-sync.test.ts:72,
 // test/helpers/providers/claude.ts:22, package.json:12). We scan the test's
-// own content here so the filter stays automatic as new tests land.
+// own content here so the filter stays automatic as new tests land. The
+// "Windows-incompatible APIs" patterns at the bottom were added after the
+// first windows-free-tests CI run surfaced concrete failure modes.
 const WINDOWS_FRAGILE_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
+  // Hardcoded POSIX shells / commands.
   { pattern: /['"`]\/bin\/(?:ba)?sh/, reason: 'hardcoded /bin/sh or /bin/bash' },
   { pattern: /spawnSync\(['"]sh['"],|spawn\(['"]sh['"],|exec\(['"]sh /, reason: 'spawn("sh", ...)' },
   { pattern: /['"]bash -c['"]|['"]sh -c['"]/, reason: 'bash -c / sh -c' },
@@ -56,6 +59,10 @@ const WINDOWS_FRAGILE_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
   { pattern: /['"]chmod\b/, reason: 'chmod shell command' },
   { pattern: /['"]xargs\b/, reason: 'xargs pipeline' },
   { pattern: /\bwhich claude\b/, reason: 'which claude (use Bun.which)' },
+  // Windows-incompatible APIs.
+  { pattern: /\.mode\s*&\s*0o[0-7]+/, reason: 'POSIX file mode bitmask (mode & 0o600 etc — Windows fakes mode bits)' },
+  { pattern: /\.endsWith\(['"]\//, reason: 'hardcoded forward-slash path assertion (Windows uses \\\\)' },
+  { pattern: /['"]\.\/[a-zA-Z][^"']*['"]\)\s*\.\s*toBe\(true\)/, reason: 'forward-slash path comparison' },
 ];
 
 export const DEFAULT_SHARD_COUNT = 20;