fix(shell): decode Windows output reliably

[h3c-hexin]

Background

This supersedes #28 after GitHub refused to reopen it because its head was rebased while temporarily closed. It continues #24 from a Pinvou-owned branch because the original head repository is no longer available for follow-up commits or workflow dispatch.

The first topic commit preserves @zhuowp as author and retains the original DCO trailer. Follow-up commits resolve the Clippy finding, make the test fixture deterministic, and add executable Windows coverage. The branch is rebased onto pinvou3-clean after the dependency advisory fix in #27 merged.

Windows-native tools may emit stdout or stderr using the active ANSI code page even when the surrounding shell is configured for UTF-8. The previous lossy, per-poll UTF-8 decoding could therefore produce mojibake and could corrupt a multibyte character split across background polls.

The reusable fix was first contributed upstream in Hmbown/CodeWhale #5602.

Changes

• preserve strict UTF-8 decoder state across shell reads
• fall back to the current Windows ACP only after genuine invalid UTF-8
• share decoding semantics across synchronous output, snapshots, raw deltas, tails, and detached readers
• seal detached streams without discarding bytes captured before the cutoff
• derive completion events and evidence from one output cutoff
• add decoder, shell-lifecycle, and forkguard_* regression coverage
• remove a behavior-neutral loop whose branches all returned, resolving clippy::never_loop
• make the incomplete UTF-8 unit test independent of the host ACP
• run focused shell regressions on windows-latest in Pinvou fork CI
• rerun the required contribution gate after PR head updates

No-Issue: replaces #28 and continues #24 from a maintainable repository-owned branch while preserving contributor credit.

Testing

• cargo fmt --all -- --check
• git diff --check
• cargo test -p codewhale-tui --lib tools::shell --locked locally (110 passed)
• cargo test -p codewhale-tui --lib tools::shell::output::tests --locked locally after the Windows test-fixture fix (9 passed)
• cargo clippy -p codewhale-tui --lib --locked --no-deps -- -A warnings -D clippy::never_loop
• Native windows-latest shell regressions before the dependency-baseline rebase (103 passed)
• Required checks and Windows regressions on the rebased combined tree (running on this PR)
• Full workspace Clippy (the public r10 baseline has unrelated Rust 1.98 warnings under -D warnings)

Risks

ACP detection is deliberately a fallback after invalid UTF-8 and cannot infer OEM or arbitrary child-selected encodings. The change is confined to the shell byte-decoding lifecycle and does not modify sandbox, PowerShell, Python, or command-generation behavior.

The contribution gate previously ran only when a PR was opened or reopened, so strict branch protection lost the required context after every update. This branch adds the missing synchronize event.

Checklist

• Updated docs or comments as needed
• Added or updated tests where relevant
• Verified TUI behavior manually if UI changes (not a UI change)
• Harvested/co-authored credit uses a GitHub numeric noreply address (not applicable; the original signed commit is preserved)

[zhuowp]

@h3c-hexin Pinvou/pinvou-agent#348 has now been realigned to the final merged maintenance head 665b46cd9e67326459223aa662931bd36d726004. The immutable pinvou-v0.9.5-r11 tag is still absent, and zhuowp has read-only access to Pinvou/CodeWhale, so I could not publish it. Please create the annotated immutable tag at that exact SHA; the parent verifier will remain fail-closed until the tag is public.