fix(windows): run daemon without console window

[sean2077]

Summary

Replace the Windows Scheduled Task PowerShell launcher with a wscript.exe //B //NoLogo VBScript launcher. The launcher starts the console-subsystem binary with window style 0, so daemon startup and restart no longer leave a PowerShell console visible.

It preserves the configured log and environment variables, retry behavior, and working directory; removes legacy .ps1 launchers on reinstall or uninstall; and stops launcher children plus a verified lock-file process as a safe orphan fallback. This PR also includes the two minimal Windows source-build fixes required for the current main branch to compile on Windows.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing behavior to change)
• Documentation only
• Internal refactor / chore (no user-visible change)

Testing

• Passed: go test ./daemon -run '^(TestBuildWindowsTaskScript|TestBuildWindowsTaskScript_DropsInvalidEnvName|TestBuildWindowsTaskScript_DropsEmptyValue|TestWindowsTaskActionUsesWindowlessScriptHost|TestWindowsTaskCreateUsesLimitedInteractivePrincipal|TestWindowsTaskMatchesActionRequiresExactAction|TestPowerShellLiteralEscapesSingleQuotes|TestVBScriptLiteralEscapesDoubleQuotes|TestSchtasksInstallRemovesLegacyPowerShellLauncher|TestStopWindowsTaskKillsLauncherChildrenAndLockedInstance)$' -count=1
• Passed: go test ./agent/pi -run '^$' -count=1
• Passed: go build -tags no_web ./...
• Manual Windows verification: reinstalled and restarted the local scheduled task; confirmed its action is wscript.exe //B //NoLogo ...cc-connect-daemon.vbs, with both wscript.exe and cc-connect.exe reporting MainWindowHandle = 0. Feishu reached platform ready and engine started.
• go build ./... requires generated web/dist assets, which this clean local worktree does not contain; CI builds those assets before its normal build step.
• go test ./daemon -count=1 still fails the existing Windows-only precondition in TestSchtasksInstall_TightensExistingScriptFrom0644 because this filesystem reports a seeded mode of 0666, not 0644.
• Full go test -tags no_web ./... has existing Windows-only failures in path, shell, PTY, and file-mode assumptions outside this change.

Automated tests added in this PR

• TestWindowsTaskActionUsesWindowlessScriptHost in daemon/windows_test.go - verifies the scheduled task uses wscript.exe //B //NoLogo instead of PowerShell.
• TestVBScriptLiteralEscapesDoubleQuotes in daemon/windows_test.go - verifies safe VBScript string generation.
• TestSchtasksInstallRemovesLegacyPowerShellLauncher in daemon/windows_test.go - verifies upgrade cleanup of the old PowerShell launcher.
• TestStopWindowsTaskKillsLauncherChildrenAndLockedInstance in daemon/windows_test.go - verifies launcher-child and verified lock-PID cleanup are emitted.

For bug fixes only - regression test

• Regression test name: TestWindowsTaskActionUsesWindowlessScriptHost
• Manual verification this test catches the regression:
  • Reverted the fix locally; the regression test failed as expected.

Critical User Journeys (CUJ) impact

• No CUJ touched (Windows daemon lifecycle only)

Manual / user-visible behavior change

On Windows, cc-connect daemon install and cc-connect daemon restart now run the service with no visible PowerShell console window. Existing installations migrate away from the old PowerShell launcher on reinstall.

Checklist

• Focused Windows daemon regression tests pass
• go build -tags no_web ./... passes
• No secrets / credentials in source
• No new hardcoded platform/agent names in core/
• go test ./... passes locally (see Windows-only baseline failures above)

Related

• Issue: none