fix(cli): default Windows subprocess text decoding

[rylena]

Summary

• Adds a Windows-only guard that defaults Hermes CLI text-mode subprocess pipes to UTF-8 with replacement decoding.
• Preserves explicit caller-provided encoding / errors choices.
• Covers text=True, universal_newlines=True, positional universal_newlines, and encoding/errors-triggered text mode.

Closes #47939

Verification

• scripts/run_tests.sh tests/hermes_cli/test_windows_subprocess_text_decoding.py ✅ (6 passed)
• python scripts/check-windows-footguns.py --all ✅
• Added-line static scan for secrets, shell injection, eval/exec, pickle, and SQL formatting: no findings
• Independent delegated code review: passed

Codex was attempted first for repo-safe implementation, but it hit the known hidden-workspace / CA-bundle sandbox failures and could not inspect the checkout, so Hermes handled the fallback implementation and verification directly.

[alt-glitch]

Duplicate of #48838 — both PRs fix #47939 by monkeypatching subprocess.Popen.__init__ in hermes_cli/__init__.py to default text-mode pipes to encoding="utf-8" / errors="replace" while preserving explicit caller choices. Same file, same issue, same mechanism (filed ~1 minute after #48838). The only difference is this PR gates the shim to sys.platform == "win32"; #48838 applies it cross-platform. Anchoring to the earliest still-open PR.

[tonydwb]

Code Review Summary

Verdict: Approved — Windows subprocess text decoding fix.

• 2 files changed (+187/-0)
• Fixes default Windows subprocess text decoding
• No security concerns, no debug artifacts

---

Reviewed by Hermes Agent

[rylena]

Closing this as a duplicate of #48838 for the same Windows subprocess text-decoding fix, so review effort stays concentrated on the earlier open PR.