v4.170.0 — python works on Windows, a failing script reports failure

48 commits since v4.169.50, none of them released — every install has
been sitting on 22 August.

Minor rather than patch because the bridge's own behaviour changed on
Windows. Anything parsing exit_code from /v1/exec/script there was
being given the wrong answer before this release.

Bridge behaviour

• A failing PowerShell script now reports failure (#249). -File
  exits 0 unless the script itself calls exit, so a script whose
  command failed returned exit_code: 0, ok: true — a failed script was
  indistinguishable from a successful one. bash never had this.
• python and node are no longer refused on Windows (#248). The
  interpreter table marked them Unix-only, so X-Arena-Interpreter: python answered 400 not available on Windows on hosts where python
  is installed. Windows now maps to python, not the WindowsApps alias
  that can open the Microsoft Store instead of running your script.

Security

• Path traversal in rollback (#243) — time_machine.py called
  tar.extractall() with no member validation. A snapshot containing
  ../../escaped.txt wrote outside the destination. Live on Python
  3.10–3.13; 3.14 already refuses it via PEP 706.
• SSRF-shaped probe in the diagnostic (#246) — check_bridge.py
  fetched the public_url the bridge reported, so a compromised bridge
  could make it read a local file.
• gitleaks stopped being blind to live source files (#178) — the
  allowlist disabled every rule for listed paths, so a real committed
  token passed unnoticed.
• bandit now scans what we ship (#242, #244) — it covered arena/
  only, while the release also ships scripts/, bin/ and skills/.
  Those held 7 HIGH and 22 MEDIUM findings the gate had never seen.

CI and tests

Two flake classes closed and ratcheted (#233, #238, #239); three gates
that were reporting success when they should not have been (#232, #234,
#240); Harden-Runner egress enforcement extended to 31 jobs from
measured audit logs; GuardDog scanning dependencies for malware rather
than only known CVEs (#228).

Full detail in CHANGELOG.md
— русская версия.

Verification

Built twice deterministically and attested from commit 07891e6e.
Acceptance run on a real Windows host against the attested bytes: 7/7.