fix: suppress console window flashes on Windows via global subprocess patch (#53282)

[Sahil-SS9]

Fixes #53282

Description

On Windows, every subprocess.Popen of a .exe spawns a visible console window briefly unless CREATE_NO_WINDOW (0x08000000) is passed in creationflags. The codebase has ~300 subprocess call sites; only a handful use windows_hide_flags().

Rather than touching every call site (a large, fragile mechanical diff), this PR adds a global monkeypatch in hermes_cli/_subprocess_compat.py that auto-injects CREATE_NO_WINDOW into every subprocess.Popen / run / call / check_output / check_call call on Windows when creationflags is not already provided.

Key design decisions:

• Popen is replaced with a proper subclass (not a plain function), preserving isinstance checks and subclassability. Several tests and the process registry subclass Popen; a plain function wrapper would break them.
• Explicit creationflags from callers that set their own (e.g. DETACHED_PROCESS for daemons) are preserved.
• Idempotent — safe to call multiple times.
• No-op on non-Windows — the function returns immediately.
• Called from hermes_cli/__init__.py at import time so the patch is active before any tool or gateway code runs.

Verification

• Compile-checked both modified files
• All 66 existing Windows compatibility tests pass
• Verified on Linux: Popen is unchanged (no-op), Popen remains a class, isinstance works, subprocess calls function normally
• Quality gates: S1 (secrets) clean, S2 (personal refs) clean, C1 (conventional commits) clean, F1 (focused diff — only the two target files)

[kaizen-commits]

Had Hermes implement this patch.. Can confirm, that’s the best kind of temporary patch: ugly in the right way, quiet in the UI, and easy to verify later.

[teknium1]

Closing as superseded by the consolidated Windows console-flash work tracked in #54220.

The relevant pieces from this PR/cluster have now landed through the targeted follow-up PRs #54236, #53892, and #54417, or are recorded in the umbrella tracker for any remaining native-Windows verification. Keeping this separate PR open would duplicate the tracker and the merged follow-up work.

Thanks for digging into this — the reports and PRs in this cluster helped identify the remaining spawn legs.