ci(pregate): gstack-pregate joins the Windows pregate job; pregate tests return to the Windows lane (#3197)

- windows-pregate-e2e runs gstack-pregate run (preflight: regen, secrets
  through the gstack-redact bun bin, literals, guards) in both journeys, and
  asserts a missing GSTACK_GIT_BASH refuses with one WTREE_UNAVAILABLE --json
  envelope.
- test/helpers/pregate-fixture.ts and restamp-fixture.ts runBin launch bins
  through lib/script-invocation.ts (bun bins as Bun argv, bash bins through
  Git Bash on Windows), which removes the "shebang via CreateProcess" reason
  for the pregate tests; they move from KNOWN_WINDOWS_INCOMPATIBLE to
  KNOWN_WINDOWS_SAFE.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

scripts/lib/windows-curation.ts

@@ -51,17 +51,10 @@ const WINDOWS_FRAGILE_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
 // when possible; this list is for environment-/runtime-specific tests where
 // the failure mode is structural rather than detectable via source-file scan.
 export const KNOWN_WINDOWS_INCOMPATIBLE: Array<{ file: string; reason: string }> = [
-  // C-pregate: these drive bin/gstack-regen, bin/gstack-pregate, bin/gstack-issue-links and
-  // bin/gstack-ship-receipt through test/helpers/pregate-fixture.ts runBin (spawnSync on the
-  // shebang file, which CreateProcess cannot exec) and run `node gen.js` / `node --test` fixture
-  // commands through the pre-gate's POSIX `bash -o pipefail` runner. The pure parsers and the
-  // import graph are covered by test/pregate-selection.test.ts, which the bin/ pattern excludes too.
-  { file: 'test/gstack-regen.test.ts', reason: 'spawns bin/gstack-regen through test/helpers/pregate-fixture.ts runBin (shebang via CreateProcess) and POSIX fixture regen commands' },
-  { file: 'test/pregate-guards.test.ts', reason: 'spawns bin/gstack-pregate through test/helpers/pregate-fixture.ts runBin (shebang via CreateProcess) and runs node guard and lane fixture commands through the POSIX runner' },
-  { file: 'test/pregate-remote.test.ts', reason: 'spawns bin/gstack-pregate through test/helpers/pregate-fixture.ts runBin (shebang via CreateProcess) and runs POSIX remote-gate fixture commands through the lane runner' },
-  { file: 'test/pregate-regate.test.ts', reason: 'spawns bin/gstack-pregate regate through test/helpers/restamp-fixture.ts runBin (shebang via CreateProcess)' },
+  // C-pregate: these drive bin/gstack-issue-links and bin/gstack-ship-receipt through
+  // test/helpers/pregate-fixture.ts runBin. The pregate tests moved to KNOWN_WINDOWS_SAFE once
+  // runBin launched through lib/script-invocation.ts (fix wave PR 5, item 10b).
   { file: 'test/stamp-templates.test.ts', reason: 'spawns bin/gstack-tree-receipt through test/helpers/restamp-fixture.ts runBin (shebang via CreateProcess)' },
-  { file: 'test/pregate-invalidation.test.ts', reason: 'spawns bin/gstack-pregate and bin/gstack-ship-receipt through test/helpers/pregate-fixture.ts runBin (shebang via CreateProcess) and the pipefail lane runner' },
   { file: 'test/ship-issue-intent.test.ts', reason: 'spawns bin/gstack-issue-links and bin/gstack-ship-receipt through test/helpers/pregate-fixture.ts runBin (shebang via CreateProcess) with a `gh` shell shim on PATH' },
   // PR E2: lane ownership and evidence verification run bin/gstack-lane-check and bin/gstack-evidence
   // through test/helpers/restamp-fixture.ts runBin (shebang via CreateProcess); the lib paths are
@@ -288,6 +281,15 @@ export const KNOWN_WINDOWS_SAFE: Array<{ file: string; reason: string }> = [
   { file: 'test/gstack-config-gbrain-refresh.test.ts', reason: 'E6: runs bin/gstack-config through explicit bash; its gbrain/python3 shims are found by bash PATH lookup, never launched by CreateProcess' },
   { file: 'test/hook-scripts.test.ts', reason: '#3067 PowerShell and NotebookEdit hook coverage: every hook runs through spawnSync("bash", [script]) with the payload on stdin, scratch state lives under os.tmpdir(); its /tmp/ literals are payload strings, never opened; symlink, newline-path and POSIX-PATH cases are skipIf win32' },
   { file: 'test/gstack-doctor.test.ts', reason: 'runs bin/gstack-doctor and setup --status through explicit bash argv in an os.tmpdir fixture; its bun/codex/claude/probe stubs are found by bash PATH lookup, and expected paths use bash spellings' },
+  // Fix wave PR 5 (item 10b, #3197): test/helpers/pregate-fixture.ts and restamp-fixture.ts runBin
+  // launch bins through lib/script-invocation.ts (bun bins as Bun argv, bash bins through Git Bash),
+  // and the pregate runner runs fixture commands through the resolved Git Bash.
+  { file: 'test/gstack-regen.test.ts', reason: 'runs bin/gstack-regen through the fixture runBin (lib/script-invocation.ts) and its regen commands through the resolved Git Bash' },
+  { file: 'test/pregate-guards.test.ts', reason: 'runs bin/gstack-pregate through the fixture runBin (lib/script-invocation.ts); guard and lane fixture commands run through the resolved Git Bash' },
+  { file: 'test/pregate-remote.test.ts', reason: 'runs bin/gstack-pregate through the fixture runBin (lib/script-invocation.ts); remote-gate fixture commands run through the resolved Git Bash' },
+  { file: 'test/pregate-regate.test.ts', reason: 'runs bin/gstack-pregate regate through the restamp fixture runBin (lib/script-invocation.ts)' },
+  { file: 'test/pregate-invalidation.test.ts', reason: 'runs bin/gstack-pregate and bin/gstack-ship-receipt through the fixture runBin (lib/script-invocation.ts) and the lane runner through the resolved Git Bash' },
+  { file: 'test/pregate-selection.test.ts', reason: 'its bin/ strings are fixture paths; bin/gstack-pregate runs through the fixture runBin (lib/script-invocation.ts) and lanes through the resolved Git Bash' },
   {
     file: 'test/qa-evidence.test.ts',
     reason: 'invokes the production helper through Bun argv and exercises native Windows job cleanup, private file captures and backpressured receipt output',