ci: run the Python suite on Windows (#683)

Every job ran on Ubuntu, so Windows-only failures reached master with all
checks green: #480 (an atomic rename Windows file locking refuses) and #486
(non-ASCII JSON printed to a piped cp1252 stdout) passed every Linux leg and
failed on Windows 11. A new python-tests-windows job runs the full suite on
windows-latest with Python 3.14 under Git Bash, the shell Claude Code uses on
Windows, with stdout at the Windows default encoding. It is a separate job so
the five Linux legs keep the names the ruleset requires.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -83,6 +83,27 @@ jobs:
         run: python -m pip install openpyxl==3.1.5
       - run: python -m unittest discover -s tests -t . -v
 
+  python-tests-windows:
+    # Linux-green says nothing about Windows file locking, console encodings or
+    # path handling, and many users run Windows: #480 and #486 passed every Linux
+    # leg and failed there. The suite runs under Git Bash, the shell Claude Code
+    # uses for its Bash tool on Windows, with stdout left at the Windows default
+    # encoding, so a cp1252 crash shows up here the way it does for a user.
+    name: Python tool tests (Windows, Python 3.14)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.14"
+      - name: Install Excel integration test dependency
+        run: python -m pip install openpyxl==3.1.5
+      - name: Run the suite under Git Bash
+        shell: bash
+        run: python -m unittest discover -s tests -t . -v
+
   dependency-review:
     name: Dependency review
     # Requires the repo's Dependency graph, which not every repo (upstream or