fix: hide gh subprocess windows on Windows

[itsflownium]

Summary

• Apply the existing Windows hidden-window subprocess flag when reading gh auth token for Copilot credentials.
• Apply the same flag to the on-demand gh auth status doctor check.
• Add focused tests for the subprocess kwargs.

Problem
On Windows, Hermes Desktop could repeatedly spawn visible console windows while background credential resolution called the GitHub CLI. The short-lived gh subprocesses did not pass the hidden-window creation flag.

Validation

• $HOME/.hermes/hermes-agent/venv/bin/python -m pytest -q tests/hermes_cli/test_copilot_auth.py::TestResolveToken::test_gh_cli_fallback_hides_windows_console tests/hermes_cli/test_copilot_auth.py::TestResolveToken::test_gh_cli_fallback tests/hermes_cli/test_doctor.py::TestGitHubTokenCheck::test_gh_authenticated_hides_windows_console tests/hermes_cli/test_doctor.py::TestGitHubTokenCheck::test_gh_authenticated_without_env_token_shows_ok
• $HOME/.hermes/hermes-agent/venv/bin/ruff check hermes_cli/copilot_auth.py hermes_cli/doctor.py tests/hermes_cli/test_copilot_auth.py tests/hermes_cli/test_doctor.py
• git diff --check
• added-line attribution scan clean

Fixes #53957

[alt-glitch]

This was generated by AI during triage.

Canonical of the competing pair with #53962 (liuhao1024) — both fix #53957 at the same two gh spawn sites; this PR was opened ~9s earlier and additionally covers doctor.py with a dedicated test_doctor.py case. #53962 is marked as a duplicate of this one. Maintainer to pick.

[tonydwb]

Code Review Summary

Verdict: Approved

Broader version of #53962: applies windows_hide_flags() to both copilot_auth.py and doctor.py subprocess calls. The conditional if hide_flags: guard is correct (no-op on non-Windows). Both files get the same fix with a shared test. Well-scoped.

---

Reviewed by Hermes Agent

[teknium1]

Closing as superseded by the consolidated Windows console-flash work tracked in #54220.

The relevant pieces from this PR/cluster have now landed through the targeted follow-up PRs #54236, #53892, and #54417, or are recorded in the umbrella tracker for any remaining native-Windows verification. Keeping this separate PR open would duplicate the tracker and the merged follow-up work.

Thanks for digging into this — the reports and PRs in this cluster helped identify the remaining spawn legs.