fix: resolve venv executable paths on Windows

[zeukid]

Closes #40

Summary

venv_python_path() and venv_pip_path() in sia/layout.py hardcoded the
POSIX venv layout (bin/python, bin/pip). On Windows a venv places its
executables in Scripts\python.exe / Scripts\pip.exe, so every subprocess SIA
launches against the per-run venv pointed at a path that doesn't exist — sia run
could not complete on Windows.

This branches on os.name to return the correct path per platform. POSIX output
is byte-identical to before, so all existing call sites in run_setup.py
(pip install, both the uv and stdlib-venv branches) and orchestrator.py
(_run_target_agent, run_evaluation) are fixed transitively. The Docker
sandbox path is unaffected (it runs a Linux container).

The limitation was already noted in docs/onboarding.md ("Common Pitfalls").

Changes

• sia/layout.py — platform-aware venv_python_path / venv_pip_path via a
  shared _venv_bin_dir helper (Scripts + .exe on Windows, bin elsewhere).
• tests/test_layout.py (new) — parametrized over os.name so both the
  Windows and POSIX layouts are asserted on any host, plus a guard that POSIX
  output is unchanged.
• .github/workflows/ci.yml — scoped windows-latest job running
  tests/test_layout.py to guard the fix on a real Windows runner.

Testing

• New tests/test_layout.py: 5 passed.
• Full suite on Linux is unaffected (POSIX output unchanged). ruff check and
  ruff format --check pass on the changed files.

Notes

• The Windows CI job is intentionally scoped to test_layout.py: a handful of
  existing tests carry pre-existing POSIX-only assumptions (/dev/null,
  LF-pinned golden snapshots, file reads missing encoding="utf-8") that fail on
  Windows independently of this change. Making the full suite Windows-clean is
  a separate follow-up (test fixtures + a .gitattributes for line endings).

[Abhishek21g]

Verified locally on rebased branch (Abhishek21g/sia pr/41-windows-paths): 134 tests passed, clean 4-file diff. Independent of #36/#51 — ready to merge.

[Abhishek21g]

Verified locally on rebased branch (Abhishek21g/sia pr/41-windows-paths). Independent — can merge anytime alongside #36/#51.