Skip the two Linux-release-only checks on Windows in-file instead of growing the shard list

scripts/test-free-shards.ts

@@ -341,14 +341,6 @@ export const KNOWN_WINDOWS_INCOMPATIBLE: Array<{ file: string; reason: string }>
     file: 'test/cso-witness.test.ts',
     reason: 'tests the contained repair witness with POSIX private-directory and compiled-helper assumptions; comprehensive execution is unavailable on Windows',
   },
-  {
-    file: 'test/cso-native-evidence.test.ts',
-    reason: 'runs the Linux Docker qualification suites to read their real Bun JUnit report; native gate evidence is produced only on the Linux staging runners',
-  },
-  {
-    file: 'test/cso-requalification.test.ts',
-    reason: 'digests the image-embedded repository bytes exactly as the Linux release runners check them out; a Windows checkout may rewrite line endings, and requalification triggers are produced only in Linux staging',
-  },
   {
     file: 'test/shard-engine-equivalence.test.ts',
     reason: 'its classification golden was recorded from the POSIX runners (process-group wall kill); the win32 engine path is pinned by the mocked-platform case in shard-engine.test.ts',

test/cso-native-evidence.test.ts

@@ -85,7 +85,7 @@ describe('CSO native gate evidence', () => {
     expect(() => parseJUnit('<?xml version="1.0"?>\n<testsuites name="bun test"></testsuites>')).toThrow('EMPTY_JUNIT_REPORT');
   });
 
-  test('the real Bun JUnit report of the Docker suites names every required test, and skipped suites prove nothing', () => {
+  test.skipIf(process.platform==='win32')('the real Bun JUnit report of the Docker suites names every required test, and skipped suites prove nothing', () => {
     const dir = mkdtempSync(join(tmpdir(), 'cso-native-junit-')); temps.push(dir);
     const outfile = join(dir, 'native.xml');
     const env = { ...process.env };

test/cso-requalification.test.ts

@@ -23,7 +23,7 @@ describe('CSO runtime requalification triggers', () => {
     expect(cli.status, cli.stderr).toBe(0); expect(cli.stdout).toBe('REQUALIFICATION CURRENT\n');
   });
 
-  test('triggers cover the helper ABI, isolation policy, every image-embedded source byte, and the build inputs', async () => {
+  test.skipIf(process.platform==='win32')('triggers cover the helper ABI, isolation policy, every image-embedded source byte, and the build inputs', async () => {
     expect(current).toMatchObject({ helperAbi: 3, isolationPolicyHash: ISOLATION_POLICY_HASH, buildInputsRevision: buildInputs.revision });
     const files = await imageSourceFiles();
     for (const file of ['lib/cso/verifier.ts', 'lib/cso/preparation-container.ts', 'lib/cso/contracts.ts', 'lib/cso/images/entrypoint', 'lib/cso/images/rails.Dockerfile']) expect(files).toContain(file);