ci: add a Windows lane for the unit/typecheck/build suite

The pure-logic code carries real win32 branches (shell parsing, WSL path
projection, the PowerShell installer) that mock-injection tests alone
cannot validate. Mirror the ci job on windows-latest (Git Bash as the
step shell) for typecheck / test / build / consumer-type-surface; the
plugin-mount lane (real DSH + Playwright) stays ubuntu-only.

check-consumer-types.sh: force MSYS winsymlinks:nativestrict so Git
Bash's ln -s creates real symlinks instead of deep-copying the repo
(node_modules + full .git history) — inert on Linux/macOS.

.github/workflows/ci.yml

@@ -50,6 +50,49 @@ jobs:
       - name: Check consumer type surface
         run: pnpm check:consumer-types
 
+  # Windows parity lane for the pure-logic suite. The codebase carries real
+  # win32 branches (shell parsing, WSL path projection, the PowerShell
+  # installer) that mock-injection tests alone cannot validate — this lane
+  # runs the same typecheck / test / build / consumer-type-surface steps on
+  # a real Windows runtime. The plugin-mount lane (real DSH + Playwright
+  # Chromium) stays ubuntu-only and is deliberately NOT mirrored here.
+  ci-windows:
+    runs-on: windows-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        # The runner ships Git Bash: multi-line steps and
+        # scripts/check-consumer-types.sh work verbatim.
+        shell: bash
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # Tests run git log against this repository and need the full history.
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: pnpm
+      # Same rationale as the ci job: smoke tests spawn git without an
+      # identity and rely on ambient config, which the runner lacks.
+      - name: Configure git identity for tests
+        run: |
+          git config --global user.name "dsh-better-sidebar-ci"
+          git config --global user.email "ci@dsh.invalid"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck
+        run: pnpm typecheck
+      - name: Test
+        run: pnpm test
+      - name: Build
+        run: pnpm build
+      - name: Check consumer type surface
+        run: pnpm check:consumer-types
+
   # Pack the plugin as an npm tarball, mount it into a REAL DSH instance
   # through the official `dsh plugin --profile web add` channel, and render
   # the DSH web UI headlessly (Playwright Chromium) to prove the plugin

scripts/check-consumer-types.sh

@@ -10,6 +10,13 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
+# Git Bash (MSYS) `ln -s` deep-copies directories by default — copying this
+# repo (node_modules + full .git history) would be catastrophic. Force real
+# native symlinks instead: the GitHub Windows runners (Developer Mode, admin
+# user) can create them, and nativestrict makes ln fail loudly rather than
+# silently falling back to a copy. Inert on Linux/macOS.
+export MSYS="winsymlinks:nativestrict"
+
 # The check reads the BUILT declaration surface (lib/types) — fail loudly
 # instead of silently passing when the build output is missing.
 if [ ! -f lib/types/client/service.d.ts ]; then