[windows-integration] Update `windows-cli-integration.yml` to use safe issue creation and reduce oversized inline script risk

### Summary
The existing `.github/workflows/windows-cli-integration.yml` already satisfies most required behavior (daily schedule + dispatch, multi-job orchestration, Ubuntu build artifact, Windows integration matrix-style checks, timeout/hang detection, chaos/negative checks, and `conclusion` aggregation with `if: always()`).

A targeted update is still needed to align with current workflow execution constraints and improve maintainability:

- Replace direct `gh issue create` in the `conclusion` job with a write path that is robust in restricted/auth-variant environments used by agentic runs.
- Refactor the very large inline PowerShell/C# ConPTY probe block into a checked-in script file to reduce YAML fragility and make failures easier to debug.

### Why change is needed
- Current conclusion step depends on `gh` auth/runtime assumptions and can fail under environments where CLI auth is unavailable or restricted.
- The workflow file is currently very large (`~32 KB`) and includes a long embedded C# block, which is difficult to review and maintain and increases risk of quoting/escaping breakage.

### Required updates
- In `.github/workflows/windows-cli-integration.yml`:
- Keep existing trigger, matrix coverage, timeout protections, and final pass/fail semantics.
- Replace the issue-creation mechanism in `conclusion` with a repository-standard resilient pattern (for example `actions/github-script` with explicit permissions), while preserving run URL and failed job summary details.
- Keep minimal explicit permissions at workflow/job level.
- Add a script file for the ConPTY startup probe and invoke it from the workflow (preserve current checks and timeout behavior).

### Acceptance criteria
- Workflow still runs on `schedule` and `workflow_dispatch`.
- Build and integration jobs continue to perform existing required checks across `pwsh`, Windows PowerShell, and `cmd` paths with timeout-based hang defense.
- `conclusion` runs with `if: always()`, fails workflow when required jobs fail, and files an issue containing failed jobs + run URL.
- No unrelated workflow changes.

### File references
- `.github/workflows/windows-cli-integration.yml:1
- `.github/workflows/windows-cli-integration.yml:610

> [!WARNING]
>
> Firewall blocked 1 domain
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `ab.chatgpt.com`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "ab.chatgpt.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [🪟 Daily Windows Terminal Integration Builder](https://github.com/github/gh-aw/actions/runs/34807413646) · codex · gpt53codex · 7.8 AIC · ⌖ 2.69 AIC · ⊞ 13.8K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fdaily-windows-terminal-integration-builder%22&type=issues)

Start with .github/workflows/windows-cli-integration.yml, especially the conclusion job near line 610 and the embedded ConPTY PowerShell/C# probe. Trace the existing triggers, matrix checks, timeout behavior, permissions, and final aggregation before evaluating the workflow's issue-creation path and the proposed checked-in script boundary. Done means the stated acceptance criteria remain intact, including schedule and dispatch triggers, cross-shell checks, failure aggregation, and an issue containing failed jobs and the run URL.

Written by the indexing model from the issue text.