fix(tools): add windows_hide_flags to backend version probes

[liuhao1024]

What does this PR do?

On Windows, when Hermes runs without an attached console (gateway service, cron-fired runs, or detached workers), subprocesses spawned without CREATE_NO_WINDOW get a fresh visible console window. Two backend version probes in tools/terminal_tool.py (docker and singularity/apptainer) were missing windows_hide_flags(), causing brief console flashes during backend health checks.

This PR adds creationflags=windows_hide_flags() to both probe calls. On non-Windows platforms, windows_hide_flags() returns 0, so behavior is unchanged.

Related Issue

Fixes #62734

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• tools/terminal_tool.py: Add from hermes_cli._subprocess_compat import windows_hide_flags import
• tools/terminal_tool.py:2815: Add creationflags=windows_hide_flags() to docker version probe
• tools/terminal_tool.py:2821: Add creationflags=windows_hide_flags() to singularity/apptainer version probe

How to Test

On Windows:

1. Configure TERMINAL_ENV=docker or TERMINAL_ENV=singularity
2. Run Hermes as a detached process or cron job (no attached console)
3. Observe that docker version / apptainer --version probes no longer flash console windows

On non-Windows (macOS, Linux):

1. Verify existing functionality is unaffected: check_terminal_requirements() returns correct results for local/docker/singularity backends
2. Run existing tests: pytest tests/tools/test_terminal_tool_requirements.py -q — should pass

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15.2

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — Windows-specific fix, no impact on non-Windows
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[teknium1]

Thanks for the focused Windows fix. The two changed calls correctly use the existing helper, whose documented contract is CREATE_NO_WINDOW on Windows and 0 elsewhere (hermes_cli/_subprocess_compat.py:186-201).

Problems

• The same active backend preflights remain unprotected: DockerEnvironment calls _ensure_docker_available() at tools/environments/docker.py:621, whose docker version call is at tools/environments/docker.py:520-526; SingularityEnvironment calls _ensure_singularity_available() at tools/environments/singularity.py:178, whose version call is at tools/environments/singularity.py:47-50. These paths can still spawn visible Windows console windows.
• This PR changes no tests. Existing preflight tests at tests/tools/test_docker_environment.py:99-120 and tests/tools/test_singularity_preflight.py:49-71 do not cover the required flag.

Suggested changes

• Apply windows_hide_flags() to both environment-level preflight calls and add mocked assertions for all affected probes.

Automated hermes-sweeper review.

[teknium1]

This fixes the tool-availability check, but the active Docker construction path still invokes the separate unprotected docker version preflight at tools/environments/docker.py:520-526 via DockerEnvironment at line 621. Please cover that sibling path (and the analogous Singularity preflight) so detached Windows execution does not still flash a console.

[teknium1]

Closing in favor of PR #66605, which covers both of these probe sites plus the sudo -n true probe and adds regression tests for all three (its own review thread already identifies the overlap).

You were the first submitter for the docker/singularity probe sites (July 11, a week ahead) — your diagnosis was correct and will be credited if/when the consolidated fix lands. Note the user-visible symptom itself was fixed at the root by PR #70205 (hidden-console daemons, commit 0dbf639); the remaining value of flagging these sites is consistency/defense-in-depth.