feat(linter): detect subprocess text=True without explicit encoding=

[jinglun010-cpu]

Summary

Adds a new rule to scripts/check-windows-footguns.py that flags subprocess.run/Popen/call/check_output/check_call(..., text=True, ...) calls missing an explicit encoding= kwarg.

On Chinese Windows (cp936/GBK) and other non-UTF-8 default codepages, text=True without encoding= decodes child output with locale.getpreferredencoding(False), crashing _readerthread with UnicodeDecodeError on non-default-codepage bytes (issues #47939, #53428, #57238).

PR #55339 and #60741 fixed 27 existing call sites manually. This rule prevents future regressions — the same class of bug can never silently land again.

Rule Design

• Pattern: matches text=True / text = True
• post_filter skips lines that:
  • already pass encoding= on the same line
  • are method definitions (def text)
  • contain text=True inside string literals
  • are not subprocess-shaped calls (heuristic via _is_likely_subprocess_call)
• Two helper functions: _is_likely_subprocess_call, _looks_like_string_literal
• Multi-line calls where subprocess.X( and text=True are on different lines are not flagged (acceptable false negative for a line-based scanner)

Changes

File	Change
scripts/check-windows-footguns.py	New rule + 2 helper functions + fix linter's own get_staged_files/get_diff_files footgun
tools/voice_mode.py	Suppress 2 false positives (Termux/Android only)
tools/environments/singularity.py	Suppress 1 false positive (Linux HPC only)
plugins/google_meet/cli.py	Suppress 1 false positive (macOS system_profiler)
tests/scripts/test_footgun_subprocess_encoding.py	21 unit tests

Test Plan

• TestDetection (6 tests): verifies the rule flags real subprocess calls (subprocess.run, Popen, check_output, _sp.run alias, bare .run(, text = True with spaces)
• TestSuppression (7 tests): verifies false-positive avoidance (encoding= present, inline suppression marker, non-subprocess APIs like DataFrame.rename, string literals, def text, comments)
• TestHelpers (7 tests): unit tests for _is_likely_subprocess_call and _looks_like_string_literal
• TestFullRepoScan: scans the whole tree with only the new rule and asserts it finds exactly the 7 call sites that PR fix: add explicit UTF-8 encoding to remaining subprocess text=True calls (#53428) #60741 fixes (or zero, once fix: add explicit UTF-8 encoding to remaining subprocess text=True calls (#53428) #60741 merges)
• Full-repo scan: 7 expected matches on main (the fix: add explicit UTF-8 encoding to remaining subprocess text=True calls (#53428) #60741 sites), 4 platform-exclusive calls correctly suppressed, zero false positives across 752 files

Relationship to PR #60741

This PR is complementary to #60741:

• fix: add explicit UTF-8 encoding to remaining subprocess text=True calls (#53428) #60741 fixes the 7 existing call sites in tools/ and hermes_cli/
• This PR adds a linter rule so the same class of bug is caught automatically in future PRs

Once both merge, scripts/check-windows-footguns.py --all reports zero violations for this rule class. CI's lint job (which runs the footgun linter per CONTRIBUTING.md) will block any new regression.

Supersedes the manual audit approach — no more "fix 21 locations, miss 6 more" situations (which is exactly how #60741 was needed after #55339).

[teknium1]

Thanks for adding a preventive check for a real Windows decoding failure mode. The current implementation needs a current-main audit before it can become a blocking CI rule.

Problems

• The new rule would flag current hermes_cli/claw.py:82-84 and hermes_cli/claw.py:96-99; CI runs --all (.github/workflows/lint.yml:159-160), whose roots include hermes_cli/ (scripts/check-windows-footguns.py:570-580).
• --all omits tui_gateway/ (scripts/check-windows-footguns.py:568-581), and the line-based design misses the multi-line subprocess.run(..., text=True) at tui_gateway/server.py:11747-11757.
• TestFullRepoScan in 7165772b35be relies on fix: add explicit UTF-8 encoding to remaining subprocess text=True calls (#53428) #60741's superseded seven-site scope. fix: add explicit UTF-8 encoding to remaining subprocess text=True calls (#53428) #60741 is now narrowed to one file at f8c507e1b5cf; its discussion records that the other sites were dropped.

Suggested changes

• Re-audit against current main, coordinating with the broader open rollout fix: add explicit UTF-8 encoding to all subprocess text=True calls (#53428) #55339.
• Detect complete multi-line calls and include tui_gateway/ in the CI roots.
• Replace the PR-number allowlist with a clean-baseline assertion after the existing violations are resolved.

Automated hermes-sweeper review.

[teknium1]

Merged via PR #70875 — your linter commit was cherry-picked onto current main with your authorship preserved in git log (rebase merge). The rule is what closes this bug class for good: it verified the full 163-site sweep (807 files scanned, zero findings) and any future text=True without encoding= now fails CI. Nice design on the suppression comments and the string-literal guard — they survived salvage untouched.