ci: make cargo test blocking on every OS (fix the 14 Unix-path tests)

[Amir-SSVLabs]

What

The follow-up named in the #12 and #14 reviews: the Windows (and Linux) cargo test legs ran under continue-on-error, so nothing behind #[cfg(target_os = "windows")] had a gate that could go red — a compile error in the mic watcher would have shown green. This PR fixes the 14 tests that forced warn mode, then deletes the warn-mode step so cargo test blocks on all three OSes.

Also carries the two non-blocking review notes as a second commit: the misfiled watcher doc block (back on default_mic_watch), and a written-down statement that an indeterminate probe deliberately doesn't reset signedOutStreak.

The 14 failures, by kind

Kind	Tests	Fix level
url::to_file_path is platform-specific by design (driveless /home/... errors on Windows)	clipboard ×5	fixtures — per-platform URI/path pairs, identical assertions
Scan labels rendered with display() → plans\feat.md on Windows	files ×2	production — labels are UI-facing logical names; new slash_label helper renders / everywhere. Its second call site fixes the same latent bug in the AGENTS.md scan, which the hierarchical test caught only after the first site was fixed
normalize_path lowercases on Windows (NTFS case-insensitivity — correct)	history ×1	assertion — expect the platform-correct value
Fixtures hand-formatted TOML with raw Windows paths — \U parses as a unicode escape, config fails to parse, rules silently never apply	codex skills ×4, community_skills ×2	fixtures — TOML literal strings + native-separator joins (rule match is exact string equality against the scanner's path); community_skills pair now compares PathBufs so the slug layout is asserted without the separator

Production TOML writes were checked before concluding fixture-only: toggle_codex_skill_with_overrides writes through toml_edit, which escapes — real users can't hit the parse failure the fixtures did.

Why the ratchet is safe

• 740/740 on this Windows host after the fixes (was 726/14).
• The pull_request: trigger runs CI on this PR itself, so the newly-blocking legs validate here before they can gate anyone else's merge.
• macOS behaviour unchanged — it was already blocking.

What stays in warn mode

prettier, svelte-check, and clippy — unchanged, still red on main for pre-existing reasons (svelte-check needs a one-line @types/node devDependency; happy to do that ratchet next).

🤖 Generated with Claude Code

[alonmuroch]

Approving. The ratchet is the right call and the fixes underneath it hold up.

I checked the two changes that carry real risk, since the rest is fixtures:

slash_label is genuinely display-only. MemoryFileCandidate.label is consumed in exactly one place — {md.label} at +page.svelte:12044 — while path keeps the real OS path. So rendering plans/feat.md instead of plans\feat.md breaks no lookup, and the second call site in the AGENTS.md scan is the same latent bug, correctly fixed.

normalize_path really does lowercase on Windows (history.rs:73-76), so the #[cfg(windows)] assertion is the platform-correct value rather than a weakened one. The NTFS reasoning in the new comment is right.

The TOML diagnosis is correct — \U in a basic string is a unicode escape — and so is the conclusion that production is immune because toml_edit escapes on write. Good instinct to check that before settling on fixture-only.

Two notes, neither blocking:

• The community_skills PathBuf comparisons are now slightly tautological — the expected value is built with the same join chain as the subject. They still pin the slug rewrite and the directory layout, which is what those tests are for, so this is fine; just worth knowing they no longer assert anything about rendering.
• The TOML literal strings break if a path ever contains a '. Temp dirs won't, so this is a note for whoever copies the pattern.

On the ratchet itself: making Windows/Linux cargo test blocking is clearly right — #[cfg(target_os = "windows")] code currently has no gate that can go red, which is exactly how a compile error in the mic watcher would have shipped green. The pull_request: trigger validating it on this PR is the correct way to prove it. The cost is that a future Windows-runner flake blocks merges; worth taking.

Merge this before #18 — the @types/node commit there sets up the svelte-check ratchet named at the end of this description, and the two +page.svelte hunks don't overlap.