test: add fail-closed Windows observer research gates

.github/workflows/windows-native-observer.yml

@@ -0,0 +1,65 @@
+name: Windows native observer static gate
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - experimental/windows-native-observer/**
+      - .github/workflows/windows-native-observer.yml
+  push:
+    branches: [main]
+    paths:
+      - experimental/windows-native-observer/**
+      - .github/workflows/windows-native-observer.yml
+
+permissions:
+  contents: read
+
+jobs:
+  static:
+    name: Windows PowerShell 5.1 parse, pure helpers and compile (no native calls)
+    runs-on: windows-2022
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Static gate without running the observer
+        shell: powershell
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if ($PSVersionTable.PSVersion.Major -ne 5) { throw 'This gate requires Windows PowerShell 5.1' }
+          # Do not inherit a short-name TEMP (e.g. RUNNER~1). The checker now
+          # refuses tilde spellings instead of guessing their physical target.
+          if ([string]::IsNullOrWhiteSpace($env:RUNNER_TEMP)) { throw 'RUNNER_TEMP is required' }
+          $compilerRoot = [IO.Path]::GetFullPath($env:RUNNER_TEMP)
+          if ($compilerRoot -notmatch '^[A-Za-z]:\\' -or $compilerRoot.Contains('~')) { throw 'RUNNER_TEMP must use a long absolute drive spelling' }
+          $compilerTemp = Join-Path $compilerRoot ('codex-observer-static-' + [Guid]::NewGuid().ToString('N'))
+          if (Test-Path -LiteralPath $compilerTemp) { throw 'Compiler scratch already exists' }
+          $sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+          $acl = New-Object Security.AccessControl.DirectorySecurity
+          $acl.SetOwner($sid)
+          $acl.SetAccessRuleProtection($true, $false)
+          $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')))
+          [IO.Directory]::CreateDirectory($compilerTemp, $acl) | Out-Null
+          # Process-local compiler environment only; no host policy/settings change.
+          $env:TEMP = $compilerTemp
+          $env:TMP = $compilerTemp
+          $dir = Join-Path $env:GITHUB_WORKSPACE 'experimental/windows-native-observer'
+          & powershell -NoProfile -NonInteractive -File (Join-Path $dir 'check.ps1')
+          if ($LASTEXITCODE -ne 0) { throw "check.ps1 exited $LASTEXITCODE" }
+          Write-Output 'Static gate passed; no observer mode, Codex binary or native observation was run.'
+
+  evaluator:
+    name: Evaluator unit tests (synthetic records)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 22.13.0
+      - name: Run evaluator tests
+        run: node --test experimental/windows-native-observer/test/*.test.mjs