ci: verify the shared hook lib on Windows

.github/workflows/ci.yml

@@ -256,6 +256,47 @@ jobs:
       paths: .
       fail-on-severity: low
 
+  # The ONLY job on a Windows runner, and deliberately so. Every other suite in
+  # this repository is platform-agnostic bash string logic that a Linux runner
+  # exercises identically — `lib/powershell/ps-command.sh`, for instance, carries
+  # zero `OSTYPE`/`cygpath`/`uname` branches despite classifying PowerShell
+  # commands, so Linux tests it faithfully.
+  #
+  # `lib/hook-utils.sh` is the exception: it carries OSTYPE-gated branches that a
+  # Linux runner NEVER EXECUTES — case-insensitive path folding for the Windows
+  # filesystem, and `cygpath` short-name (8.3) resolution. Those branches were
+  # previously verified only by whatever a maintainer happened to run on a dev
+  # box. This job is what makes them a gate — but only because it is also listed
+  # in the `ci-status` needs graph below. `ci-status` is the single required merge
+  # check, so a lane missing from that list is informational no matter how loudly
+  # a comment here calls it a gate: the aggregate would report success while this
+  # lane was red.
+  #
+  # Free: GitHub Actions is free for public repositories on standard
+  # GitHub-hosted runners, Windows included; only larger runners are charged.
+  # https://docs.github.com/en/billing/managing-billing-for-your-products/managing-billing-for-github-actions/about-billing-for-github-actions
+  #
+  # Keep this job SMALL. Adding a platform-agnostic suite here buys no coverage
+  # and pays Windows' process-creation cost (~140ms/spawn vs ~3ms on Linux),
+  # which is the whole reason the full suite is unusable on a Windows dev box.
+  # Pinned, not `windows-latest`: the runner policy forbids the floating
+  # `*-latest` labels outright (policy.json forbiddenHostedRunnerLabels), for the
+  # same reason the Linux lanes pin ubuntu-24.04 — an image roll must be a
+  # reviewed commit, not a silent Tuesday.
+  hook-utils-windows:
+    runs-on: windows-2025
+    timeout-minutes: 20
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run shared lib tests on Windows
+        run: bash lib/hook-utils.test.sh
+
   hook-utils-sync:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
@@ -960,6 +1001,7 @@ jobs:
     needs:
       - hygiene
       - hook-utils-sync
+      - hook-utils-windows
       - parse-concern-value-sync
       - resolve-convention-pattern-sync
       - standards-contract-sync