hygiene: Windows CI lane runs zero family-crate tests (default-members nextest blind spot)

[heyoub]

Context

Surfaced by #222/#223 (2026-07-12): the first-ever native Windows execution of netbat's lib tests — a local run of the new test-docs lane — found drain_budget_bounds_one_flood_pass failing on Windows because it assumed Linux-sized kernel socket buffers (fixed in #223). The failure had been invisible for the test's entire life.

The gap

cargo xtask ci-windows-surface (commands/ci.rs) runs run_nextest_ci(["--all-features"]) bare — no --workspace — so nextest covers only default-members (crates/core). The family crates (syncbat, netbat, hostbat, bvisor, macros, tools) get checked and clippy'd on Windows (checks always did; clippy since #221) but their tests never run there. Any family-crate test or code path with a host-environment assumption (socket buffers, path semantics, file locking, timing) is unverdicted on Windows — not green, not red, just absent.

This is the third instance of the same blind-spot class closed this cycle:

• Windows clippy: installed but never invoked (closed by hygiene(#178): manifest-deny the doctrine lints, all-features doc gate, Windows clippy #221)
• feature-gated rustdoc: default-features build never compiled it (closed by hygiene(#178): manifest-deny the doctrine lints, all-features doc gate, Windows clippy #221)
• family tests on Windows: this issue

Notes / constraints

• The comment on ci_fast_test() records why bare nextest is a known trap: the same default-members hole previously let an integrity self-test fixture rot on Linux until --workspace was added to the fast lane.
• Cost: the Windows lane is label-gated (run-windows / run-heavy-ci / proof=windows), so wider test coverage there costs nothing on default PRs.
• Expect discoveries, not clean green: fix(netbat-test): pin Windows socket buffers so the TLS drain-budget flood stages #223's class predicts more host-assumption failures when family tests first run on Windows (that is the point). Each gets the fix(netbat-test): pin Windows socket buffers so the TLS drain-budget flood stages #223 treatment — fix the test's environmental assumption, never weaken the property.
• Related: structural-on-Windows and Windows path/canonicalization qualification are routed to GAUNT-REPO-IR-CONVERGENCE: one repository fact plane for architecture, assurance, and Muterprater #211; this issue is only about the test-execution surface.

Acceptance shape

1. The Windows surface runs family-crate tests (e.g. --workspace on its nextest, or an explicit family loop mirroring run_family_tests()), with any genuinely Linux-only tests handled by explicit, documented cfg — not silent exclusion.
2. First run's discoveries are triaged fix(netbat-test): pin Windows socket buffers so the TLS drain-budget flood stages #223-style (environmental assumption fixed, property untouched) or filed individually.
3. AGENTS.md's ci-windows-surface description stays accurate.

Refs: #223 (the discovered instance), #221 (Windows clippy precedent), #211 (Windows fact-plane), issue #178 closing comment (blind-spot class record).