Windows CI follow-ups deferred from the #871 review

[janicduplessis]

Non-blocking findings from the fresh review of #871 that were deferred so the PR could land. Each is small; they can go in one PR.

• packages/stim-cli/src/diagnostics/sandbox.ts covers(): the glob strip (/\/+\*+$/) runs before path normalisation, so on Windows C:\Users\me\.stim\* keeps its * and never matches. Normalise, then strip.
• packages/stim-cli/src/engine/errors-gradle.ts:304: .replace(/\r$/, '') changes macOS parsing too ("FAILURE: Build failed\r" used to return ""). Correct, but unguarded and untested, and mostly dead since createLineReader strips CR upstream. Add a test or drop it.
• packages/stim-cli/src/fs-util.ts:108: uncShareIsReachable calls statSync directly instead of the statFn that isOnMountedVolume was given, so it is untestable and ignores injection.
• packages/stim-cli/src/process-output.ts:26: flush() does not strip a trailing \r, unlike push(); a CRLF final line without newline leaks the CR.
• .github/workflows/ci.yml: branches: [main, '**windows**'] makes every job, including the macOS lanes, run on push to any windows-named branch, duplicating the PR run. Scope the push trigger to the Windows jobs only.
• .github/workflows/ci.yml: job-level TEMP/TMP point at a directory created by a later New-Item step, so actions/checkout runs with a non-existent TEMP. Create it first or set the env on the steps after it.
• .github/workflows/ci.yml: the comment "the job's own colour tracks the suite" is wrong; job-level continue-on-error: true makes it green regardless. Fix the comment or move continue-on-error to the step.

The EPERM to contended mapping in ownership-claim.ts is tracked separately in the claim liveness issue.

[janicduplessis]

Claimed: @janic/ci-windows-trigger (the ci.yml items; the code items stay open here). Note: the job-colour comment is accurate after all, job-level continue-on-error keeps the run green but the job still reports failure, as the #871 checks showed. Dropping that item.

[janicduplessis]

Dropping the TEMP-before-checkout item: actions/checkout wipes the workspace (prepareExistingDirectory / git clean -ffdx), so creating e2e-tmp first would delete it. The original order is correct and the probe jobs ran fine with it. #886 covers the two ci.yml trigger items and promotes the Windows unit suite to a blocking lane.