CI: Windows test jobs fail on every run since 2026-08-26 (journal rollup PermissionError + CLI-outside-PATH lookup)

[CryptoJones]

Both Windows matrix jobs (windows-latest, 3.10 and 3.14) have failed on every run since 2026-08-26 — on main and on every PR — independently of #294 (which is now fixed by #295). Linux and macOS are green.

The 8 failures are the same on every run:

FAILED tests/test_ai_usage.py::test_resolve_finds_a_cli_outside_path - AssertionError: installed CLI outside PATH was not found
FAILED tests/test_cli.py::test_rollup_compacts_a_week_of_journals - PermissionError: [Errno 13] Permission denied
FAILED tests/test_journal.py::test_rollup_week_produces_parseable_summary_and_archives - PermissionError: [Errno 13] Permission denied
FAILED tests/test_journal.py::test_rollup_delete_removes_dailies - PermissionError: [Errno 13] Permission denied
FAILED tests/test_journal.py::test_rollup_default_respects_retention - PermissionError: [Errno 13] Permission denied
FAILED tests/test_journal.py::test_rollup_is_idempotent_per_week - PermissionError: [Errno 13] Permission denied
FAILED tests/test_journal.py::test_rollup_note_stays_out_of_listings - PermissionError: [Errno 13] Permission denied
FAILED tests/test_journal.py::test_rollup_late_daily_keeps_archived_days - PermissionError: [Errno 13] Permission denied

Two distinct causes:

1. Journal rollup on Windows — seven PermissionError: [Errno 13] failures. The rollup archives/deletes dailies; on Windows a file that is still open (or was just written) cannot be renamed/unlinked, which is the classic NTFS sharing-violation shape. Likely a handle left open by the writer or the reader before the archive move.
2. test_resolve_finds_a_cli_outside_path — the resolver that finds model CLIs installed off PATH (fix(verify): find model CLIs that are installed but not on a hook's PATH #271) does not find the fixture on Windows; probably an executable-suffix (.exe/.cmd) or a ~/.local/bin-style path assumption.

Neither job is a required check, so mergeStateStatus reads UNSTABLE rather than BLOCKED, which is why PRs still merge — but it means the Windows matrix currently carries no signal at all. Example run: https://github.com/CryptoJones/omind/actions/runs/33800438606