test(windows): curate the seven POSIX-bound files the expanded lane surfaced; fix flag-utils path embedding

First full run of the expanded Windows lane (13 -> ~258 files, PR #2593
run 31918591602) failed in exactly 8 files. One was a real test bug,
fixed: design-flag-utils embedded a raw Windows ROOT into a bun -e
string where backslashes act as escapes (D:\a\gstack imported as
D:agstack) — forward slashes work on every platform. The other seven
are POSIX-bound in ways the content patterns cannot see (sed/ln/bash
ARE their subject, a shebang shim arrives via variable, wall-clock
retry bounds on the slowest runner) — each gets a receipted
KNOWN_WINDOWS_INCOMPATIBLE entry, and the census pin now covers that
list so a renamed file fails the suite instead of silently keeping a
stale exclusion.

test/test-free-shards.test.ts

@@ -18,6 +18,7 @@ import {
   DEFAULT_WALL_TIMEOUT_MS,
   PER_FILE_WALL_MS,
   wallTimeoutForShard,
+  KNOWN_WINDOWS_INCOMPATIBLE,
   TEST_ROOTS,
   TREE_MUTATING,
   WORKER_HOSTILE,
@@ -535,6 +536,12 @@ describe('test-free-shards: curated-list census pins', () => {
     expect(stale).toEqual([]);
   });
 
+  test('every KNOWN_WINDOWS_INCOMPATIBLE entry names a real free test file', () => {
+    const census = new Set(collectFreeTestFiles(ROOT));
+    const stale = KNOWN_WINDOWS_INCOMPATIBLE.map((e) => e.file).filter((f) => !census.has(f));
+    expect(stale).toEqual([]);
+  });
+
   test('every TEST_ROOTS entry exists on disk and contributes at least one test file', () => {
     const files = collectFreeTestFiles(ROOT);
     for (const root of TEST_ROOTS) {