[Bug][Windows] Sandboxed subprocess spawn flashes a visible console window from GUI hosts; STARTF_USESHOWWINDOW + SW_HIDE fixes it without the 0xC0000142 crash

[a1580311461-glitch]

Bug report (posted under General — this repo has no bug/feedback category)

### Environment
- OS: Windows
- Node: v22.19.0
- dsh: 0.1.0-rc.6, run from a console-less GUI host (desktop app / Electron)

### Problem
Every confined command (e.g. the pwsh tool under `workspace-write`/sandbox
mode) spawns the child with a **visible console window that flashes** on
screen, because the host process has no console and the child is created with
`dwCreationFlags = 0` and no window-show directive.

### Root cause
In `@deepseek-ai/dsh-sandbox-windows-acl` (`lib/types/spawn.ts`, shipped as
`lib/types-*.js`), `spawnSandboxed` / `spawnSandboxedInherited` build a
STARTUPINFOW with only `STARTF_USESTDHANDLES` and call `CreateProcessAsUserW`
with `dwCreationFlags = 0`:
```js
encodeStartupInfo(startupInfo, { cb: 104, dwFlags: 256, hStdInput: ..., hStdOutput: ..., hStdError: ... });
api.createProcessAsUserW(token, null, commandLine, null, null, 1, 0, null, options.cwd, startupInfo, processInfo);

The module comment explains why CREATE_NO_WINDOW / CREATE_NEW_CONSOLE are
intentionally absent: under this restricted-token scheme, hidden-console
children die with STATUS_DLL_INIT_FAILED (0xC0000142) (verified empirically).
But with no flag at all, a console-less GUI parent causes every child to get a
brand-new visible console window.

Suggested fix (verified working, no crash)

Keep dwCreationFlags = 0 (avoiding the 0xC0000142 path) and instead hide the
new console via STARTUPINFO: add STARTF_USESHOWWINDOW (0x1) to dwFlags and
set wShowWindow = SW_HIDE (0):

encodeStartupInfo(startupInfo, {
  cb: 104,
  dwFlags: 257,        // STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW
  wShowWindow: 0,      // SW_HIDE
  hStdInput: ..., hStdOutput: ..., hStdError: ...
});

Tested on Windows: the sandboxed pwsh runs normally (stdio pipes unaffected,
sandbox enforcement intact) and no console window appears. This applies to both
spawnSandboxed (foreground) and spawnSandboxedInherited (background/runner)
paths. Note: the same fix needs to land in every shipped copy of the package
(CLI node_modules + any desktop-host bundle), since desktop apps bundle their
own @deepseek-ai/* dependency tree.