Windows path-handling sweep (0.2)

[pmclSF]

Context

In 0.1.2 we added Windows to the CI matrix (round-4 review finding). That surfaced a cluster of pre-existing path-handling bugs and one long-running test that block a fully-passing Windows runner. We landed enough fixes to keep the matrix on (gitignore matcher, repository scan, content analysis, context walker, golden tests, SARIF redaction tests), but the remaining failures are out of scope for 0.1.2.

The Windows runner is currently continue-on-error: true so regressions stay visible without blocking merges. This issue tracks bringing it back to required.

Failing tests on Windows (as of c7b615a)

Path-key mismatches (filepath.Join → backslash, downstream expects /)

• internal/heatmap: TestBuild_DirectoryHotSpots_NormalizedByFileCount — directory roll-up keys come back with backslash separators.
• internal/impact: TestInferChangedPackages — "unexpected package: internal\\auth" — package inference uses raw filepath.Dir output without ToSlash.
• internal/migration: TestComputeReadiness_MixedFrameworkUnevenCoverage, TestComputeReadiness_ShallowlyTestedMigrationRisk — migration heuristics look up paths in maps keyed by forward-slash strings.
• internal/scoring: TestComputeRisk_DirectoryRollup — directory rollup map is keyed by filepath.Dir output rather than ToSlash-normalised path.

Long-running / hung test

• cmd/terrain: TestAIWorkflow_InventoryJSON_IncludesEvidence — hung 9m58s before the Windows job timed out at 10m. Likely a stdin/pipe wait that doesn't terminate cleanly on Windows.

Approach

1. Add a single "path key normalisation" helper (or just inline filepath.ToSlash calls) at every place we build a directory or package key from a file path, mirroring the fix applied to internal/analysis/{repository_scan,content_analysis,context}.go.
2. Add a Windows-only smoke test or table-driven test for each affected package that asserts forward-slash output.
3. Investigate the AI-workflow hang separately — likely a cmd.Wait() or os.Stdin interaction that needs a context-cancellable variant.
4. Once green, flip required: true for the Windows matrix entry in .github/workflows/ci.yml and remove the continue-on-error line.

Acceptance

• All Windows tests pass three runs in a row without flakes.
• continue-on-error: ${{ !matrix.required }} is removed; Windows is a required check.
• Round-4 finding A2 ("single-OS coverage") is fully closed.

[pmclSF]

Update (commit ec5042d): the cmd/terrain hang was a real bug, not a Windows-only quirk — both captureRun (cli_smoke_test.go) and TestAIWorkflow_InventoryJSON_IncludesEvidence were redirecting os.Stdout through an os.Pipe and only draining the reader after the function returned. On Linux/macOS the ~64 KB pipe buffer hides this for typical JSON output; Windows pipes are ~4 KB and deadlock the moment a command writes more than a few thousand bytes.

Fixed by draining concurrently in a goroutine. The Windows skip on TestAIWorkflow_InventoryJSON_IncludesEvidence is removed — it now passes on all OSes. Notably, the same fix unblocked TestCLISmoke_ReportingCommands/posture, which had the same pattern via captureRun.

Remaining 0.2 work is just the 5 path-handling bugs (heatmap/impact/migration×2/scoring) — all share the same filepath.Dir-without-ToSlash root cause.