Linux CI red since Oct 2025: cache_policy_test is Windows-only but built unconditionally

Documenting a completed diagnosis (verified locally, fix tested but not applied) — both failing CI jobs share one root cause.

## Root cause

`cache_policy_test` cannot compile on Linux — it pulls in Windows SDK / WinFsp headers:

```
include/ce-win-file-cache/security_descriptor_builder.hpp:10:10: fatal error: sddl.h: No such file or directory
```

Include chain: `test_cache_policy.cpp` → `hybrid_filesystem.hpp` → `directory_cache.hpp` → `types/directory_tree.hpp:4` → `security_descriptor_builder.hpp:10` (`#include `, guarded only by `#ifndef NO_WINFSP`).

The workflows pass `-DNO_WINFSP=ON`, but that's a CMake *variable*; the compile *definition* is added per-target in `src/test/CMakeLists.txt`, which deliberately skips it for `cache_policy_test` ("needs HybridFileSystem"). And it can't just be defined: `HybridFileSystem` only exists inside `#ifndef NO_WINFSP` (it subclasses `Fsp::FileSystemBase` from ``), and `test_cache_policy.cpp` uses it unconditionally. The target is inherently Windows-only but sits in the unconditional `TEST_PROGRAMS` list.

The **"Check for warnings"** job fails from the *same* thing, not from real warnings: it greps the build log and its `grep -i "error:"` matches the three `sddl.h` `fatal error:` lines. There are zero actual warnings.

## History

- Last green Tests run on main: 2025-10-03 (`9ea1ef1`).
- First red: 2025-10-06 (`9e95cc6`, "various fixes dirtree, cache and perf") — **the commit that added `cache_policy_test` to the build list**. It has never compiled on Linux. Not runner-image drift; "Windows Build with WinFsp" passes because the real Windows SDK exists there.

## Verified fix (two hunks in `src/test/CMakeLists.txt`)

1. Remove `cache_policy_test` from the unconditional `set(TEST_PROGRAMS ...)` (~line 23) and append it only when it can build:
```cmake
# cache_policy_test exercises the real HybridFileSystem, which requires WinFsp
# and the Windows SDK (sddl.h etc.), so it can only be built on Windows/Wine.
if(WIN32 OR USE_WINE_WINDOWS_API)
list(APPEND TEST_PROGRAMS cache_policy_test)
endif()
```
2. Guard its discovery (~line 115), else CMake configure fails on Linux:
```cmake
if(TARGET cache_policy_test)
catch_discover_tests(cache_policy_test)
endif()
```

Verified locally under both CI configurations (GCC 15.2, stricter than the runner's): Tests config builds clean and `run_all_tests_linux.sh` passes 14/14 (10/10 CTest); the Code Quality config builds with zero `warning:`/`error:` lines, so the warnings job would pass. The Windows job is untouched and still builds/runs the test.

Optional hardening: the `#ifndef NO_WINFSP` guards around `` in `security_descriptor_builder.hpp:10` and `hybrid_filesystem.cpp:11-13` would be more honest as `#if defined(_WIN32) && !defined(NO_WINFSP)`, since `NO_WINFSP` is a target-level opt-in rather than a platform signal.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Start in src/test/CMakeLists.txt and inspect how TEST_PROGRAMS and catch_discover_tests(cache_policy_test) are defined. Build the Tests and Code Quality configurations on Linux, then conditionally include cache_policy_test only for Windows/Wine and verify the Linux tests pass without sddl.h errors or warning-job false positives; confirm the Windows test remains included.

Written by the indexing model from the issue text.