fix: hide Windows child processes and cache Codex version checks

[dmarshall-kno2]

Background sync and Codex summary workers can open terminal windows on Windows. Each summary also repeats the Codex compatibility probe, and native Windows conversation paths lose their project name.

This change hides the existing child launches, caches compatibility checks within each worker, and uses native path parsing while preserving the unknown project fallback for a bare filename.

The compatibility cache coalesces concurrent checks, invalidates executable identity changes, retries one observed identity change, evicts failures, and bounds retained entries. Each summary still gets its own read-only ephemeral app-server. The original launch command, arguments, version floor, timeout, environment and approval policy are preserved. Sync continues exporting OpenCode before its authoritative lock check.

The installer regression distinguishes Windows direct-child termination from POSIX process-group termination. Source and affected generated distribution files are included. The MCP bundle is unchanged: same-dependency build graph and output comparisons show these changed modules do not reach that entry point. The existing MIT license is retained.

Validation on Windows against upstream 7e06519357777badd7a115d2014a7ef845904310:

• Full vendor suite: 361 passed, seven skipped across 65 files. Skips are six dangling-symlink cases and one POSIX-only installer case.
• TypeScript/esbuild build passed. Parent focused verification: 36 passed, one POSIX skip. The complete frozen patch received a separate specification and code-quality review with no unresolved findings.
• Installed integrity matched fourteen runtime/source/package files and nine hidden launch sites. Serial and concurrent synthetic batches each used one compatibility probe, with independent app-servers per request.
• Native version/initialize and redirected-IO checks passed. A bounded post-deployment observation recorded zero new windows over 60.093 seconds.

The patch remains byte-for-byte identical to the reviewed candidate. Linux/macOS execution, real model summaries, real npm installer windows and Windows grandchild termination have not been verified. The existing Ubuntu Node 22/24 PR CI remains required; the Windows results do not substitute for it.

No dependency, version, marketplace registry or release metadata changes are included. Release/version/registry publication remains with the maintainers.