fix(win): prevent UI hang — spawn git without leaking handles into the child

[Flipper1994]

What does this PR do?

Fixes a Windows-only deadlock that makes the web UI hang forever. With --ui=true,
the MCP tool list_projects never returns and, because the UI HTTP server is
single-threaded, the whole server stops responding — the UI page loads but stays
blank. Closes #798.

Root cause

list_projects shells out to git per project for git context
(git_capture → cbm_popen, src/git/git_context.c). On Windows cbm_popen was
the CRT _popen, which does CreateProcess(bInheritHandles = TRUE) and leaks
every inheritable handle into the git child — including the Winsock/AFD handles
that exist only in UI mode. git-for-Windows (MSYS2/Cygwin) classifies each inherited
handle via NtQueryObject on startup, which deadlocks on an inherited
socket/AFD handle. git never runs, so the server blocks forever in fgets on git's
stdout pipe. Confirmed with gdb: request thread in fgets/git_capture, the
git.exe child in ntdll!ZwQueryObject.

The plain MCP-stdio server and the CLI are unaffected (no socket handles to inherit),
which is why only the UI hangs.

The fix

Reimplement cbm_popen on Windows (src/foundation/compat_fs.c) to spawn via
CreateProcess + STARTUPINFOEX with an explicit
PROC_THREAD_ATTRIBUTE_HANDLE_LIST containing only the stdout write-end and a NUL
handle for the child's stdin/stderr. The git child now inherits only the pipe —
no sockets, no MCP stdin pipe, no Winsock handles — so there is no foreign handle for
NtQueryObject to deadlock on. cbm_pclose reaps the process via a small
FILE*→HANDLE table. The POSIX path is unchanged (popen already opens its pipe
O_CLOEXEC). This is centralized in cbm_popen, so it also covers the watcher
(src/watcher/watcher.c) and git-history pass, which shell out to git the same way.

Validation (Windows, production cbm-with-ui binary)

	before	after
POST /rpc list_projects (UI)	hang / timeout	200 in ~1 s, 6× stable
leftover git/cmd processes	persist forever	none
web UI in browser	blank page	renders, stays responsive

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally — note: this repo's test.sh builds with ASan/UBSan, which
  are unavailable on the MSYS2/MinGW toolchain used to reproduce this; the fix is
  #ifdef _WIN32-only and does not touch the POSIX path.
• Lint passes
• Regression test — the bug is Windows-UI-specific (needs a live HTTP server +
  git-for-Windows) and does not reproduce under the Linux CI; happy to add a
  Windows-only test under tests/windows/ if preferred.

[DeusData]

Thanks for the Windows UI hang fix for #798. Triage: high-priority Windows/UI stability.

Review will focus on the custom Windows cbm_popen implementation: handle inheritance must be closed for git-for-Windows without leaking handles, hanging the HTTP server, or changing POSIX behavior. A regression that proves list_projects returns under UI mode on Windows is the important guard.