fix(windows): capture is not a no-window boundary; route flashing spawns through chokepoint (#53829)

Follow-up to #53791 addressing review feedback: the footgun checker treated
capture_output=/stdout=/stderr=/check_output as proof a subprocess can't pop a
Windows console. That invariant is false — stream redirection controls where a
child's output goes, not whether a console is allocated. From a console-less
parent (Desktop/Electron, pythonw.exe, detached gateway/cron) a console-subsystem
child still flashes a window even when fully captured.

- check-windows-footguns.py: capture/redirect/check_output is no longer a blanket
  safe-pass. Added _WINDOWS_FLASHING_PROGRAMS (git/gh/npm/node/python/uv/ffmpeg/
  docker/powershell/…); calls to those are flagged even when captured. Non-flashing
  programs keep the capture exemption (no 271-site noise). _subprocess_compat.run/
  popen calls are inherently safe (wrapper injects CREATE_NO_WINDOW).
- Routed the 35 genuine flashing git/gh/npm/uv/ffmpeg/docker spawns through the
  _subprocess_compat.run/popen chokepoint (Brooklyn's wrapper from #53810) — the
  durable fix, not per-site annotations. cmd.exe /c start stays # ok (intentional).
- Updated tests + CONTRIBUTING.md rule #17 to the corrected invariant.

hermes_cli/dump.py

@@ -17,6 +17,7 @@ from hermes_cli.config import get_hermes_home, get_env_path, get_project_root, l
 from hermes_cli.env_loader import load_hermes_dotenv
 from hermes_constants import display_hermes_home
 from agent.skill_utils import is_excluded_skill_path
+from hermes_cli import _subprocess_compat
 
 
 def _get_git_commit(project_root: Path) -> str:
@@ -30,7 +31,7 @@ def _get_git_commit(project_root: Path) -> str:
     The output format is identical regardless of source.
     """
     try:
-        result = subprocess.run(
+        result = _subprocess_compat.run(
             ["git", "rev-parse", "--short=8", "HEAD"],
             capture_output=True, text=True, timeout=5,
             cwd=str(project_root),
@@ -65,7 +66,7 @@ def _get_git_commit_date(project_root: Path) -> str:
     build).
     """
     try:
-        result = subprocess.run(
+        result = _subprocess_compat.run(
             ["git", "log", "-1", "--format=%cd", "--date=short", "HEAD"],
             capture_output=True, text=True, timeout=5,
             cwd=str(project_root),