chore(browse): explicit windowsHide on every Bun.spawn site + census tripwire (#2575 residual)

Bun.spawn sites were structurally outside the windowsHide census (it swept
child_process bindings only). The runtime was already safe — native Bun hides
consoles by default and bun-polyfill.cjs defaults windowsHide !== false since
#2523/#2539 — but implicit defaults are exactly what regress silently. Every
Bun.spawn/spawnSync in browse/src now carries the explicit flag (harmless on
unix-only sites like Xvfb/xattr/open), and a second SWEEP in
windows-spawn-hide.test.ts fails CI on any new flagless Bun.spawn site.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

browse/src/config.ts

@@ -32,6 +32,7 @@ export interface BrowseConfig {
 export function getGitRoot(): string | null {
   try {
     const proc = Bun.spawnSync(['git', 'rev-parse', '--show-toplevel'], {
+    windowsHide: true,
       stdout: 'pipe',
       stderr: 'pipe',
       // Raised from 2s: under heavy machine load `git rev-parse` routinely
@@ -86,6 +87,7 @@ export function resolveConfig(
 function isIgnoredByGit(projectDir: string, relPath: string): boolean {
   try {
     const proc = Bun.spawnSync(['git', 'check-ignore', '-q', '--', relPath], {
+    windowsHide: true,
       cwd: projectDir, stdout: 'pipe', stderr: 'pipe',
       timeout: 2_000,
     });
@@ -160,6 +162,7 @@ export function ensureStateDir(config: BrowseConfig): void {
 export function getRemoteSlug(): string {
   try {
     const proc = Bun.spawnSync(['git', 'remote', 'get-url', 'origin'], {
+    windowsHide: true,
       stdout: 'pipe',
       stderr: 'pipe',
       timeout: 2_000,