fix(windows): stop terminal-window popups from background spawns (#53810)

* fix(windows): stop terminal-window popups from background spawns

Native-Windows desktop/gateway users saw cmd/conhost windows flash on
gateway restart, image paste, the dashboard Projects tree, voice notes,
and ~5 min after closing the app (detached cron). Two root causes:

- Console-subsystem exes (taskkill, schtasks, wmic, netstat, tasklist,
  agent-browser, git, ffmpeg, powershell, git-bash) spawned via raw
  subprocess allocate a fresh console when the launching process has
  none (pythonw desktop backend / detached gateway) - even with output
  captured.
- uv venv pythonw shims re-exec console python.exe, so Python children
  get a console regardless of how they're launched.

Fixes:
- Single hidden-spawn primitive (_subprocess_compat.run/.popen) that ORs
  CREATE_NO_WINDOW on Windows, no-op on POSIX. Route every Hermes-owned
  console-exe spawn through it.
- FreeConsole() catch-all in hermes_bootstrap: any Python child that
  exclusively owns an auto-allocated console detaches it at startup
  (GetConsoleProcessList()==1 gate leaves shared interactive consoles
  untouched).
- Replace PowerShell/wmic gateway PID scans with in-process psutil.
- Skip schtasks queries on non-interactive desktop restarts.
- Prefer native agent-browser .exe over .cmd shims.
- Guard test bans raw subprocess spawns of the Windows-only console
  tools repo-wide so the popup class can't regress.

* fix(windows): scope FreeConsole to background entry points; fix merge fallout

Console detach review (per #53810 feedback): GetConsoleProcessList()==1 can't
tell a uv pythonw->python phantom console apart from a user opening the
interactive CLI/TUI in its own fresh console (double-click, shortcut, ConPTY) —
both report a single attached process with a tty. Running FreeConsole() in the
import-time bootstrap therefore risked detaching a legitimately-interactive
terminal.

- Extract FreeConsole into explicit hermes_bootstrap.detach_orphan_console();
  remove it from apply_windows_utf8_bootstrap() (import side effect).
- Call it only from known background mains: gateway run, dashboard backend
  (start_server, what the desktop spawns), cron standalone, tui_gateway entry,
  slash worker. Interactive CLI/TUI never calls it.
- Behavior-contract tests: frees only when solo owner, leaves shared console,
  no-op without console / on POSIX, and asserts it's not an import side effect.

Merge fallout from origin/main (#53791):
- local.py: 3-way merge left a dangling **_popen_kwargs (NameError crashing
  every terminal init). _subprocess_compat.popen already hides the window, so
  drop it.
- discord adapter: merge stacked an undefined windows_hide_flags() onto the
  primitive call; drop the redundant arg.
- test_gateway: scan now goes psutil-first (zero spawn); rewrite the
  case-variant test to drive that production path.

* test(claw): mock _subprocess_compat.run seam for Windows process scan

claw.py's Windows tasklist/powershell scan routes through the hidden-spawn
primitive; the tests still patched claw_mod.subprocess, so on win32 the mock
was never hit and real spawns returned nothing. Patch the actual seam.

tests/test_hermes_constants.py

@@ -1,6 +1,8 @@
 """Tests for hermes_constants module."""
 
 import os
+import subprocess
+import sys
 from pathlib import Path
 
 import pytest
@@ -612,6 +614,30 @@ class TestAgentBrowserRunnable:
         assert agent_browser_runnable("/usr/local/bin/npx agent-browser") is True
 
 
+class TestAgentBrowserRunnableWindows:
+    def test_windows_validation_hides_console_subprocess(self, tmp_path, monkeypatch):
+        from hermes_cli import _subprocess_compat
+
+        exe = tmp_path / "agent-browser-win32-x64.exe"
+        exe.write_text("", encoding="utf-8")
+        exe.chmod(0o755)
+        captured = {}
+
+        def fake_run(args, **kwargs):
+            captured["args"] = args
+            captured.update(kwargs)
+            return type("Result", (), {"returncode": 0})()
+
+        monkeypatch.setattr(sys, "platform", "win32")
+        monkeypatch.setattr(_subprocess_compat, "IS_WINDOWS", True)
+        monkeypatch.setattr(subprocess, "run", fake_run)
+
+        assert agent_browser_runnable(str(exe)) is True
+        assert captured["args"] == [str(exe), "--version"]
+        assert "creationflags" in captured
+        assert captured["stdin"] is subprocess.DEVNULL
+
+
 class TestGetHermesDir:
     """Tests for ``get_hermes_dir(new_subpath, old_name)``.