fix(disk-hygiene): setup check detects Windows Store python3 alias stub fail-open (F3)

[kyle-sexton]

Parent

Source: handoff-inbox item 20260723-021058-disk-hygiene-0-6-4-consumer-audit (finding F3).

What to build

Close the Windows Store python3.exe alias fail-open vector: on stock Windows, WindowsApps\python3.exe is an alias stub that opens the Microsoft Store or exits without running the guard, and a failed hook launch is non-blocking (only exit code 2 blocks) — so the guard silently never gates. setup check must detect the zero-length WindowsApps alias explicitly and FAIL with remediation; README gotcha names the vector (existing gotchas cover "python3 does not resolve" but not "resolves to the Store stub").

Verify the hook-failure-semantics claim (non-blocking unless exit 2) against current hooks docs before asserting it in docs. Semver bump + CHANGELOG entry.

Acceptance criteria

• setup check FAILs with actionable remediation when python3 resolves to the WindowsApps alias stub
• README gotcha documents the vector and why it fails open
• Detection covered by a test where feasible

Blocked by

None — can start immediately.

[kyle-sexton]