test(windows): round-4 curation (spawnSkill env, symlink fixtures) + shard-log artifact

Shard 2 ran all 132 files with zero (fail) lines yet bun exited 1 —
unhandled errors in a shape neither counter names, and the Windows
lane had no log artifact to attribute them. Statically attributed and
excluded: browser-skill-commands (spawnSkill spawns bun with a
constructed env; resolution fails under Windows spawn) and
security-audit-r2 (evil-link symlink fixtures need Developer Mode).
The lane now uploads its shard logs on failure like free-tests.yml,
with os.tmpdir() pointed at runner.temp so the glob can find them.

.github/workflows/windows-free-tests.yml

@@ -109,5 +109,20 @@ jobs:
         # growing/pruning Windows coverage is one list, not two. If a test is
         # red here because it's genuinely POSIX-bound, add it to the curation
         # exclusions — don't resurrect a hand list in this file.
+        env:
+          # Point os.tmpdir() at the runner temp so the shard logs land
+          # somewhere the artifact step below can glob.
+          TEMP: ${{ runner.temp }}
+          TMP: ${{ runner.temp }}
         run: bun run test:windows
         shell: bash
+
+      # Same diagnosability contract as free-tests.yml: a red lane must
+      # carry the WHY (the runner's quiet console names files, not causes).
+      - name: Upload shard logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-free-test-shard-logs
+          path: ${{ runner.temp }}/gstack-free-test-*.log
+          if-no-files-found: ignore