fix(test): first cross-platform run of the wave's tests — Linux tmp portability + Windows-lane truthfulness

Four platform holes from the lanes' first full run over the v1.67 tests:

- uninstall neutral-root fallback hardcoded /private/tmp (macOS-only) and
  ENOENT'd on Linux CI, where the shard TMPDIR is the gstack-containing
  path that forces the fallback — now realpath'd literal /tmp.
- uninstall's kept-and-listed assertion demanded a backslash path on
  Windows while the bash uninstall prints POSIX paths — now
  separator-insensitive.
- setup-rerun's IS_WINDOWS=0 sub-case and the iron rule's force-restart
  consent path are Unix-shaped by construction (Git Bash ln -snf copies
  without Developer Mode; the consent path boots a real replacement daemon
  the browserless Windows lane cannot host) — gated off win32 with the
  reasons in place; the Windows-relevant halves still run there.
- codex-under-codex-detection drives rendered bash under a hardcoded POSIX
  PATH, so every case saw empty output on Windows — moved to
  KNOWN_WINDOWS_INCOMPATIBLE with the run receipt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/setup-windows-rerun-refresh.test.ts

@@ -274,6 +274,11 @@ describe('setup: Windows re-run refresh — behavior fixture (#2444)', () => {
     // On Unix the asset is a SYMLINK into the working tree; pruning through
     // it would delete real build output from the repo. The prune is gated on
     // the Windows real-copy shape ([ -d ] && [ ! -L ]).
+    // Not runnable ON Windows: this sub-case models the UNIX shape, but Git
+    // Bash's `ln -snf` produces a real copy there (no Developer Mode on CI),
+    // so the symlink assertion is false by platform, not by regression. The
+    // Unix lanes (macOS dev boxes + Linux CI) own this case.
+    if (process.platform === 'win32') return;
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-rerun-prune-unix-'));
     try {
       const src = path.join(tmp, 'skill-src');

test/uninstall-windows-copies.test.ts

@@ -111,7 +111,9 @@ describe('gstack-uninstall removes Windows real-dir copies (#2563)', () => {
     expect(r.status).toBe(0);
     expect(fs.existsSync(usersOwn)).toBe(true);
     expect(fs.readFileSync(path.join(usersOwn, 'SKILL.md'), 'utf-8')).toContain('name: ship');
-    expect(r.stderr).toContain(path.join('skills', 'ship'));
+    // Separator-insensitive: the bash uninstall prints POSIX paths even on
+    // Windows (Git Bash), where path.join would demand a backslash.
+    expect(r.stderr.replace(/\\/g, '/')).toContain('skills/ship');
   });
 
   test('real dir without any SKILL.md is untouched and unlisted', () => {
@@ -206,7 +208,11 @@ describe.skipIf(process.platform === 'win32')(
       // the test's own expectations). Fall back to a fixed neutral root and
       // ASSERT neutrality so the precondition can never silently rot.
       let neutralRoot = os.tmpdir();
-      if (neutralRoot.includes('gstack')) neutralRoot = '/private' + path.sep + 'tmp';
+      // realpath'd literal /tmp: /private/tmp on macOS, /tmp on Linux. The
+      // hardcoded '/private/tmp' fallback ENOENT'd on Linux CI, where the
+      // shard runner's TMPDIR is the gstack-containing path that forces this
+      // branch. (Never taken on Windows — its TMPDIR carries no 'gstack'.)
+      if (neutralRoot.includes('gstack')) neutralRoot = fs.realpathSync('/tmp');
       const neutral = fs.mkdtempSync(path.join(neutralRoot, 'other-skill-src-'));
       expect(neutral.includes('gstack')).toBe(false);
       const elsewhere = path.join(neutral, 'elsewhere.md');