test(windows): bounded_git_probe spawn-contract test seams on the Job-Object container

bounded_probe_run now spawns through local_runtime.processes.spawn_server on
Windows (CREATE_SUSPENDED + AssignProcessToJobObject on the real handle), which
a fake Popen cannot satisfy, so the probe fell to its fail-open "" and the
contract assertions never ran (windows-only job on 0eae148f0d). Fake the
container instead; the kwargs the probe hands it are the contract under test.

tests/test_windows_subprocess_no_window_flags.py

@@ -78,12 +78,19 @@ def test_bounded_git_probe_fast_path_spawn_contract_windows(monkeypatch):
     helper caches from the real platform at import. ``windows_hide_flags`` is
     still stubbed so the expected value is a fixed constant rather than
     whatever bundle the helper currently returns.
+
+    The seam is the Job-Object container (``local_runtime.processes.spawn_server``),
+    which is what the probe hands its spawn contract to on Windows; the container
+    itself adds CREATE_SUSPENDED and assigns the real process handle, which a fake
+    Popen cannot provide.
     """
     from hermes_cli import _subprocess_compat
+    from hermes_cli.local_runtime import processes
 
     spawns = []
+    fake_popen = _make_fake_popen(spawns, stdout="main\n")
     monkeypatch.setattr(_subprocess_compat, "windows_hide_flags", lambda: _CREATE_NO_WINDOW)
-    monkeypatch.setattr(_subprocess_compat.subprocess, "Popen", _make_fake_popen(spawns, stdout="main\n"))
+    monkeypatch.setattr(processes, "spawn_server", lambda cmd, **kw: (fake_popen(cmd, **kw), None))
 
     out = _subprocess_compat.bounded_git_probe(
         ["git", "-C", "C:/repo", "branch", "--show-current"], timeout=1.5