Windows: console window pops up on every browse server start (subprocess spawns missing windowsHide)

## Summary

On Windows, a console window (a **Windows Terminal** window on Win11) pops up every time the `browse` server starts. Several console-subprocess spawns are missing `windowsHide: true`.

## Environment

- Windows 11 (10.0.26200), gstack **v1.58.5.0**
- bun 1.3.14, node v22.23.1

## Root cause

On Windows, spawning a console subprocess without `windowsHide: true` allocates a console window (`windowsHide` maps to the `CREATE_NO_WINDOW` creation flag; Node's default is `false`). Enumerating top-level windows (`EnumWindows`) during server start showed the popup owned by `WindowsTerminal`, running:

- `icacls.exe` — ACL lockdown of state/log files at startup (`file-permissions.ts`, `execFileSync`)
- `tasklist.exe` — PID liveness probe (`error-handling.ts`, via the `Bun.spawnSync` polyfill)

The Bun polyfill wrapper (`bun-polyfill.cjs`) also **drops** any `windowsHide` the caller passes, so per-call fixes wouldn't stick — best fixed centrally there. Also patched the detached server launcher (`cli.ts`) and the detached telemetry spawn (`security.ts`) defensively.

## Fix

```diff
diff --git a/browse/src/bun-polyfill.cjs b/browse/src/bun-polyfill.cjs
index e0ada11..4307659 100644
--- a/browse/src/bun-polyfill.cjs
+++ b/browse/src/bun-polyfill.cjs
@@ -75,6 +75,7 @@ globalThis.Bun = {
timeout: options.timeout,
env: options.env,
cwd: options.cwd,
+ windowsHide: true, // don't pop a console window for CLI tools (icacls, tasklist, …) on Windows
});

return {
@@ -91,6 +92,7 @@ globalThis.Bun = {
stdio,
env: options.env,
cwd: options.cwd,
+ windowsHide: true, // don't pop a console window for CLI tools on Windows
});

return {
diff --git a/browse/src/cli.ts b/browse/src/cli.ts
index 59327b7..e4a9f91 100644
--- a/browse/src/cli.ts
+++ b/browse/src/cli.ts
@@ -323,7 +323,9 @@ async function startServer(extraEnv?: Record): Promise

Start in browse/src/bun-polyfill.cjs, then inspect the subprocess launchers in browse/src/cli.ts, browse/src/file-permissions.ts, and browse/src/security.ts. Run the browse server on Windows and use the issue's EnumWindows comparison to verify that icacls, tasklist, and detached server or telemetry processes no longer create console windows; Playwright's separate popup is out of scope.

Written by the indexing model from the issue text.