sia run fails on Windows: venv executable paths hardcode POSIX bin/python

[zeukid]

Summary

The per-run virtual environment helpers in sia/layout.py hardcode the POSIX
layout bin/python and bin/pip. On Windows, a venv places its executables in
Scripts\python.exe / Scripts\pip.exe, so every subprocess SIA launches
against the run venv points at a path that does not exist.

Impact

sia run cannot complete on Windows. Both code paths that touch the venv break:

• run_setup.py — _create_venv() / install_requirements() (pip install into
  the run venv, both the uv and stdlib-venv branches)
• orchestrator.py — _run_target_agent() and run_evaluation() (launching
  target_agent.py / train.py and evaluate.py with the venv's Python)

The Docker sandbox path is unaffected (it runs a Linux container). This is the
local/--sandbox none path, which is the default.

This is already noted as a known limitation in docs/onboarding.md ("Common
Pitfalls": venv_python_path() / venv_pip_path() currently build Unix-style
bin/python and bin/pip paths).

Reproduction

On Windows:
sia run --task gpqa --max_gen 1 --run_id 1

The run fails once it tries to invoke the venv interpreter, because
runs/run_1/venv/bin/python does not exist (it lives at
runs/run_1/venv/Scripts/python.exe).

Root cause

sia/layout.py:

def venv_python_path(venv_dir: str) -> str:
    return os.path.join(venv_dir, "bin", "python")

def venv_pip_path(venv_dir: str) -> str:
    return os.path.join(venv_dir, "bin", "pip")

bin / python / pip are POSIX-only; Windows uses Scripts and .exe.

Changes needed
sia/layout.py — make the two helpers platform-aware
(os.name == "nt" → Scripts\python.exe / pip.exe, else bin/python /
pip). POSIX output stays byte-identical, so all existing call sites in
run_setup.py and orchestrator.py are fixed transitively.
tests/test_layout.py (new) — parametrize over os.name so both the
Windows and POSIX layouts are asserted regardless of host OS, plus a guard
that POSIX output is unchanged.
.github/workflows/ci.yml — add a scoped windows-latest job that runs
tests/test_layout.py to guard the fix on a real Windows runner. (Scoped
rather than the full suite because several other tests carry pre-existing
POSIX-only assumptions — /dev/null, LF-pinned golden snapshots, UTF-8 file
reads — that are out of scope here and tracked separately.)
Out of scope / follow-ups
Full Windows support for the whole test suite needs separate work: test fixtures
that assume /dev/null, golden snapshots pinned to LF + / separators
(needs .gitattributes), and task-file reads missing encoding="utf-8".