Apply analysis ยง4 option 1: pssa job runs on windows-build with
shell: powershell, gated to workflow_dispatch so push/PR don't queue it when
no Windows runner is registered. The python job stays on linux-build. No job
on a Linux runner uses pwsh anymore.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Stops a main-triggered Lint run from poisoning the shared production
venv (see feature branch commit for full rationale).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Simone
Simone