ci(windows): cache bun installs; run the curated suite, not a hand list

- actions/cache on ~/.bun/install/cache keyed on bun.lock (install was
  35-45s of both 55-64s jobs, all network) and Bun pinned to 1.3.13 to
  match the other lanes.
- windows-free-tests now runs `bun run test:windows` (the runner's
  --windows-only curation) instead of a hand-listed 13-file subset that
  had drifted from the registry it sampled. POSIX-bound tests get
  excluded in ONE place (the curation patterns), not two.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/windows-free-tests.yml

@@ -43,7 +43,15 @@ jobs:
 
       - uses: oven-sh/setup-bun@v1
         with:
-          bun-version: latest
+          bun-version: 1.3.13
+
+      # bun install was 35s of a 55s job, all network. Cache keyed on the
+      # lockfile; bun's install cache lives under ~/.bun/install/cache on
+      # every platform.
+      - uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: windows-bun-${{ hashFiles('bun.lock') }}
 
       - name: Configure git identity (required by tests that init temp repos)
         run: |
@@ -93,31 +101,13 @@ jobs:
       #  - scripts/test-free-shards.ts curation logic itself
       #    (test/test-free-shards.test.ts)
 
-      - name: Show curated subset (informational — for future expansion)
-        run: bun run scripts/test-free-shards.ts --windows-only --list
-        shell: bash
-        continue-on-error: true
-
-      - name: Verify new portability work on Windows
-        # Tests targeting the v1.20.0.0 lane plus v1.30.0.0 fix-wave additions
-        # plus v1.36.0.0 Windows-install hardening (sanitizer + _link_or_copy
-        # helper + build-script subshells + doc/config-key drift guard).
-        # v1.30.0.0 extension covers icacls hardening (#1308), bash.exe telemetry
-        # wrap (#1306), and Bun.which-based binary resolvers (#1307). These must
-        # pass on Windows for the wave's "Windows hardening" framing to be honest.
-        run: |
-          bun test \
-            test/gstack-paths.test.ts \
-            browse/test/claude-bin.test.ts \
-            test/test-free-shards.test.ts \
-            browse/test/file-permissions.test.ts \
-            browse/test/security.test.ts \
-            browse/test/server-sanitize-surrogates.test.ts \
-            test/setup-windows-fallback.test.ts \
-            test/bin-windows-bun-import-paths.test.ts \
-            test/build-script-shell-compat.test.ts \
-            test/docs-config-keys.test.ts \
-            test/brain-sync-windows-paths.test.ts \
-            make-pdf/test/browseClient.test.ts \
-            make-pdf/test/pdftotext.test.ts
+      - name: Run curated Windows-safe suite
+        # Replaces the previous hand-listed 13-file subset, which drifted from
+        # the curation registry it was supposed to sample. The runner's
+        # --windows-only curation (scripts/test-free-shards.ts) is the single
+        # source of truth: POSIX-bound tests are excluded by pattern there, so
+        # growing/pruning Windows coverage is one list, not two. If a test is
+        # red here because it's genuinely POSIX-bound, add it to the curation
+        # exclusions — don't resurrect a hand list in this file.
+        run: bun run test:windows
         shell: bash

.github/workflows/windows-setup-e2e.yml

@@ -39,7 +39,14 @@ jobs:
 
       - uses: oven-sh/setup-bun@v1
         with:
-          bun-version: latest
+          bun-version: 1.3.13
+
+      # Same lockfile-keyed install cache as windows-free-tests.yml (install
+      # was 45s of a 64s job, all network).
+      - uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: windows-bun-${{ hashFiles('bun.lock') }}
 
       - name: Configure git identity
         run: |