fix(windows): hide the Stop-hook build console (#393)

[Frankie-Xu]

Summary

• The Stop hook already spawns sync-run.js with windowsHide: true, but that flag is per-spawn and is not inherited. The parent is detached with stdio: 'ignore', so it owns no console.
• realBuild's execFileSync grandchild therefore allocated a visible node.exe window on Windows for the duration of graft build.
• Pass windowsHide: true on that grandchild. Same flag on graftJson for a future console-less caller. graft init's visible stdio: 'inherit' build is unchanged.

Not in this PR

• Does not change graft init (that build is meant to be seen).
• Does not change lock / dirty / money-guard behavior of runSync.
• Does not address the separate Bug report: The auto-rebuild flashes a console window on Windows #360 report beyond the same one-line spawn flag; that issue is the same defect.

Closes #393

Test plan

• execOptsForHiddenBuild carries windowsHide: true and realBuild uses it at the execFileSync call site
• Existing GRAFT_DIR --dir argv test still passes
• node --import tsx --test --test-name-pattern "windowsHide|GRAFT_DIR is set|runSync clears" test/claude-hooks.test.ts

[github-actions]

🌱 graft blast radius

Nothing outside this diff depends on it. 1 area changed; no indexed dependents at depth 2.
Tests: 1 area updated its tests.
Tag: @anirudhkumar-nanonets — cursorSessionId · @afeddersen — cursorSessionId

Who knows this code — 2 people across 1 area

Area	Who knows it
cursorSessionId · changed	@anirudhkumar-nanonets — 2 commits, last 13d ago · @afeddersen — 1 commit, last 15d ago

Ownership is git history over each area's own files, weighted towards recent work (120-day half-life). Merge commits and bots are dropped, and you are dropped from your own PR. A name with no @ has no GitHub handle in its commit email — tag them by hand, or add a .mailmap entry. A suggestion from history, not a CODEOWNERS rule.

Test signal per changed area — 1 ✓

Reached = a node under a test path has a resolved edge into the changed symbol. It undercounts anything called indirectly — through a CLI, a spawned process or a dynamic import — so read a low ratio as “look here”, never as a coverage gate.

• ✓ cursorSessionId — 6 of 28 reached · 1 test file changed here: test/claude-hooks.test.ts
  • not reached: checkStaleCount, classifyAndScore, countTallyTurn, cursorSessionId, emit, graftJson, handleCursorMcp, handleCursorPostTool, …14 more

1 test suite also references this code

1 symbol, kept out of the diagram and the table so they cannot crowd out the areas a reviewer has to look at.

• test/hosts-codex-hooks.test.ts

_{graft blast · refs/graft/base...HEAD · depth 2 · 3 changed files}

Open the interactive graph → — click an area to see the code that changed, and the line that reaches it.