ci: add native Windows smoke workflow

[BassMantis99]

Summary

• Adds a low-risk windows-smoke GitHub Actions workflow on windows-latest.
• Installs Hermes in editable dev mode.
• Runs CLI/help smoke checks and a small targeted Windows-safe pytest subset.

Why

This is the first non-invasive Windows compatibility patch from the separate lab repo. It lives on the fork branch BassMantis99:windows/ci-smoke, so it can be rebased onto upstream updates without touching any installed Hermes checkout.

Lab tracking: BassMantis99/hermes-agent-windows-compat#20 and #24.

Test plan

• Expected to run as GitHub Actions on PR.
• No secrets required.
• Focuses on smoke coverage first; broader Windows tests can be added after the baseline is stable.

[mxnstrexgl]

LGTM — automated review passed. No security, quality, or test coverage issues detected.

[teknium1]

Thanks for adding native Windows validation; current main only has the static Windows-footgun check (.github/workflows/lint.yml:142-160), so the coverage gap is real.

Problems

• .github/workflows/windows-smoke.yml:4 bypasses the current CI orchestration model. .github/workflows/ci.yml:3-11 requires reusable workflow_call lanes, and the aggregate gate at :137-167 would not include this standalone workflow.
• .github/workflows/windows-smoke.yml:32 and :35 use mutable Action tags, contrary to the SHA-pinning rule in AGENTS.md:565-570.
• .github/workflows/windows-smoke.yml:51 uses an unlocked pip install -e .[dev]; current CI uses uv sync --locked --python 3.11 --extra all --extra dev (.github/workflows/tests.yml:83-90).

Suggested changes

• Make this a reusable Windows workflow invoked and aggregated by ci.yml.
• Pin Actions by full SHA and use the locked uv environment.
• Gate it through the central Python classifier rather than the narrower standalone path list.

Automated hermes-sweeper review.

[teknium1]

Please make this a reusable workflow_call lane and invoke it from .github/workflows/ci.yml. Current CI explicitly centralizes pull-request/push triggers and only aggregates its declared lanes; this standalone workflow would neither join all-checks-pass nor run after a push to main.

[teknium1]

Repository policy requires Actions to be pinned by full commit SHA with a version comment (AGENTS.md:565-570). Please pin this action and actions/setup-python below, matching the existing workflow convention.

[teknium1]

Please use the locked CI install path (uv sync --locked --python 3.11 --extra all --extra dev) rather than an unlocked pip install -e .[dev]. Current test CI uses that environment at .github/workflows/tests.yml:83-90; it is the supported dependency set this Windows smoke job should validate.