[BUG] Windows tests fail on Unix-only and user-specific assumptions

Summary

A full test run on Windows 11 with Python 3.14.6 produced 1,639 passes, 32 failures, and 11 skips

Most failures came from Unix assumptions or developer-specific Git settings rather than Strix product behavior

That makes it hard to tell whether a failure comes from Strix or only from a Unix-specific test

Failure breakdown

• Nineteen threat-model tests call /usr/bin/env git
• Three tests require the POSIX file mode 0600
• Two tests create filenames with control characters that Windows rejects
• One mount-policy test assumes /etc exists
• Two source-selection tests inherit the developer's global Git ignore rules
• Mypy reports missing Windows attributes for fcntl locks and os.getuid or os.getgid

Issue #648 and pull request #652 cover one permission assertion, so this issue should cover the remaining shared test infrastructure

Proposed cleanup

• Resolve Git with shutil.which("git")
• Test the Windows security contract instead of POSIX mode bits where appropriate
• Create control-character filenames only on filesystems that support them
• Select protected system paths through a platform helper
• Isolate Git tests from GIT_CONFIG_GLOBAL and GIT_CONFIG_SYSTEM
• Guard platform-specific imports so Windows type checking does not resolve unavailable APIs

Why this cleanup matters

uv run pytest should stop failing because a fixture assumes Unix behavior or inherits a developer's Git configuration

Where Windows cannot provide the same filesystem behavior, the test should explain the platform-specific skip instead of hiding a product failure