* fix(snapshot): survive cold PowerShell starts in Windows staging gates
CI run 31775262530, checks-windows-node-test-1 attempt 1, showed the fail-closed ACL probe timing out during PowerShell first-use module preparation. Centralize encoded one-shot spawning, budget 60 seconds for cold starts, and preserve the underlying probe failure as the error cause.
* fix(snapshot): sanitize PowerShell failure causes in Windows staging gates
* fix(secrets): explain the sanitized plan-file failure cause suppression
check-lint-core-2 flagged preserve-caught-error at the private plan file
catch; retaining the raw error would re-leak the -EncodedCommand argv the
sanitization contract strips, so the suppression is intentional (same
idiom as setup-inference-activate.ts).
* test(lint): register the private-plan-file suppression in the inventory
* test(infra): give the LAN-host real PowerShell spawn a cold-start budget
checks-windows-node-test-2 (run 31804325922) hit the same cold-start flake
class this PR fixes: the codepage-proof test spawns real powershell.exe
bounded at 3s, which a cold runner cannot meet. Production keeps its
fail-open 3s route-hint probe; only the test's real-spawn verification
uses the shared cold-spawn budget.
Peter Steinberger
b4f91fadf3