ci(windows): use windows-latest-8-cores instead of unregistered Blacksmith label

actionlint failed PR #1505 because `blacksmith-2vcpu-windows-2022` isn't
in the repo's approved runner-label list (actionlint.yaml only registers
`ubicloud-standard-2`, and Ubicloud doesn't ship a Windows pool).

Switch to GitHub's paid larger Windows runner `windows-latest-8-cores`
— 4x the cores of the free `windows-latest` at the larger-runner billing
rate, no new third-party CI provider, no actionlint config changes.

CHANGELOG: replace "Blacksmith" / "blacksmith-2vcpu-windows-2022" /
"~6x faster spin-up" claims with the actual choice (8 cores vs 4, paid
larger runner).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/windows-free-tests.yml

@@ -8,11 +8,11 @@ name: Windows Free Tests
 # targeted resolver tests that exercise the Bun.which-based claude binary
 # resolution + the GSTACK_CLAUDE_BIN override path on Windows.
 #
-# Runner: migrated v1.36.0.0 from GitHub-hosted `windows-latest` to Blacksmith's
-# paid Windows runner. Spin-up is ~10s vs ~60s and Bun installs land 3-4x faster.
-# If Blacksmith isn't configured for this org, swap to `windows-latest` (the
-# free GitHub runner, slower but always available). Namespace, Ubicloud-Windows,
-# and other paid pools work too — just match your org's billing.
+# Runner: migrated v1.38.0.0 from GitHub-hosted `windows-latest` to the paid
+# GitHub-hosted `windows-latest-8-cores` runner — 4x more cores at GitHub's
+# larger-runner billing rate. Ubicloud doesn't ship Windows runners (only
+# Linux), so we stay GitHub-hosted. Swap to `windows-latest` to revert to
+# the free runner if billing/quota becomes an issue.
 #
 # What this DOES NOT do (still out of scope, tracked as follow-up):
 #   - Run the full free suite on Windows. The 24 tests that hardcode /bin/sh,
@@ -33,10 +33,9 @@ concurrency:
 
 jobs:
   windows-free-tests:
-    # Paid faster Windows runner. Verify the label matches what's enabled for
-    # this repo's Blacksmith installation. Common alternatives:
-    #   blacksmith-4vcpu-windows-2022, namespace-profile-windows, windows-latest
-    runs-on: blacksmith-2vcpu-windows-2022
+    # Paid GitHub-hosted larger Windows runner (8 cores vs the free 4-core
+    # windows-latest). To revert: swap to `windows-latest`.
+    runs-on: windows-latest-8-cores
     timeout-minutes: 15
 
     steps:

CHANGELOG.md

@@ -9,7 +9,7 @@ Windows users who pull `git pull && ./setup` now get fresh skill files for every
 
 The browse server's Unicode sanitization lifts from `handleCommand` (PR #1463's original target) to `handleCommandInternal` so the batch command path (`/command/batch`) inherits it too. Both SSE producers (activity feed at `/activity/stream` and inspector stream) now stringify with a `sanitizeReplacer` function that cleans every string value during JSON.stringify — post-stringify regex is ineffective there because `JSON.stringify` has already converted `\uD800` into the escape sequence `"\\ud800"` before the regex would run. Result: every page-content payload that ships from the server has lone UTF-16 surrogate halves replaced with U+FFFD before any downstream consumer (Anthropic API, sidebar JSON.parse) sees them.
 
-The `windows-free-tests.yml` CI lane migrates from GitHub-hosted `windows-latest` to a paid faster Windows runner (Blacksmith). Spin-up drops from ~60s to ~10s and Bun installs land 3-4x faster. Four new wave tests get registered: sanitizer unit + bug-repro + wiring invariants, setup helper static-invariant + behavior matrix, build-script POSIX-shell sanity, and a doc-vs-config deprecated-key drift guard. Docs that still referenced the renamed `gbrain_sync_mode` config key now say `artifacts_sync_mode` consistently, and the drift guard prevents reintroduction.
+The `windows-free-tests.yml` CI lane migrates from GitHub-hosted `windows-latest` to GitHub's paid larger `windows-latest-8-cores` runner — 4x the cores at the larger-runner billing rate. Ubicloud doesn't ship a Windows pool, so we stay GitHub-hosted rather than introducing a new third-party CI provider just for one Windows job. Four new wave tests get registered: sanitizer unit + bug-repro + wiring invariants, setup helper static-invariant + behavior matrix, build-script POSIX-shell sanity, and a doc-vs-config deprecated-key drift guard. Docs that still referenced the renamed `gbrain_sync_mode` config key now say `artifacts_sync_mode` consistently, and the drift guard prevents reintroduction.
 
 Contributed by @realcarsonterry: PRs #1460, #1461, #1462, and #1463 are the seed of this wave. The scope expansion to all 42 setup sites + every server egress path + Windows CI migration is the gstack maintainer's follow-through.
 
@@ -24,7 +24,7 @@ Source: this branch's diff against `origin/main` and the wave plan at `~/.claude
 | Bash brace groups in `package.json` build script (Bun-Windows-hostile) | 3 | 0 | -3 |
 | Stale `gbrain_sync_mode` references in docs | 5 | 0 | -5 |
 | New regression tests | 0 | 29 (4 files) | +29 |
-| Windows CI runner spin-up | ~60s (windows-latest) | ~10s (Blacksmith) | ~6x faster |
+| Windows CI runner cores | 4 (windows-latest) | 8 (windows-latest-8-cores) | 2x cores at larger-runner billing rate |
 
 The static invariant test (D7) reads `setup` and asserts zero raw `ln` calls outside the `_link_or_copy` helper body — even a single one-line slip by a future contributor fails the build.
 
@@ -46,7 +46,7 @@ If you run gstack on Windows: `./setup` now produces a working install across ev
 - **`browse/src/server.ts`** — `handleCommandInternal` split into `handleCommandInternalImpl` (raw) + thin sanitizing wrapper. Single egress point for both HTTP and batch consumers. Inline INVARIANT comment near the wrapper documents the architectural constraint.
 - **`browse/src/server.ts` SSE producers** — activity feed (`/activity/stream`) and inspector stream stringify with `sanitizeReplacer`, a `JSON.stringify` replacer function that cleans every string value during encoding. Post-stringify regex is a no-op because `JSON.stringify` has already converted `\uD800` to `"\\ud800"` before the regex could match. Inline INVARIANT comment in each.
 - **`setup`** — new `_link_or_copy SRC DST` helper near `IS_WINDOWS` detection (~line 33). Auto-dispatches on file-vs-directory + Windows-vs-Unix, and skips Unix-style name-only aliases (e.g. `gstack/open-gstack-browser` for the connect-chrome alias) when the source doesn't resolve on disk so Windows installs don't abort under `set -e`. All 42 prior `ln -snf` call sites converted to `_link_or_copy`. New `_print_windows_copy_note_once` helper called from `link_claude_skill_dirs` after any link work completes. `cleanup_old_claude_symlinks` and `cleanup_prefixed_claude_symlinks` extended with a Windows branch so `--prefix` / `--no-prefix` flips remove stale real-file SKILL.md copies instead of leaving them behind.
-- **`.github/workflows/windows-free-tests.yml`** — `runs-on: windows-latest` → `runs-on: blacksmith-2vcpu-windows-2022`. Test-list expanded to include the 4 new wave tests.
+- **`.github/workflows/windows-free-tests.yml`** — `runs-on: windows-latest` → `runs-on: windows-latest-8-cores` (paid GitHub-hosted larger runner). Test-list expanded to include the 4 new wave tests.
 - **`package.json`** — build script's three `{ git rev-parse HEAD 2>/dev/null || true; } > path/.version` brace groups replaced with `( ... )` subshells. POSIX-universal, Bun-Windows-compatible.
 - **`docs/gbrain-sync.md`, `docs/gbrain-sync-errors.md`** — 5 stale `gbrain_sync_mode` config-key references → `artifacts_sync_mode` (the rename landed in v1.27.0.0 but two docs still pointed at the old key).