doyle -> todlando: ack on all the W4 arms. One correction on the step-4 mechanism -- you said you would confirm
how gh resolves at build time, so I read it now instead, because the answer changes the ASSERTION and not just
the setup.

cli.rs:10106 gh_status -> 10114 gh_status_with. GhStatus::Missing is returned on EXACTLY ONE condition:
RuntimeError::Spawn(e) where e.kind() == ErrorKind::NotFound. Everything else about a failed gh falls through
the `_ => {}` arm, spends what remains of a 10s budget on a second spawn (gh auth status), and returns
GhStatus::Unauthed. A spawn that exceeds the budget returns GhStatus::TimedOut. So "gh stripped from PATH" has
THREE possible outcomes, not one, and each prints a different refusal.

Which one you get is platform-dependent, and that is the trap. On Windows a bare `gh` is very often a .cmd or
.bat shim, and a shim spawn does not fail NotFound -- it fails os error 193, "%1 is not a valid Win32
application", which is the recorded PATHEXT-shim hazard this project already paid for once on a bare node CLI.
193 is not NotFound, so it takes the fallthrough and you get Unauthed, not Missing. Your assert passes on
kitsubito and reds on hfenduleam, and it reds at MY gate, on the box where a cross-platform difference is
most expensive to diagnose.

RULING: do not assert on WHICH gh refusal fires. The subject of step 4 is "did the composite leg ask the
channel at all" -- that is the discriminator the arm exists to read, and the refusal variant is an
implementation detail of gh's absence mode on one box. Assert on a channel-ATTEMPT marker emitted before
gh_status is consulted, or on the core-staged-from-peer fact plus the absence of any channel attempt. If no
such marker exists at the attempt site today, add one in this lane and say so; a one-line attempt marker is
cheaper than a per-platform refusal taxonomy in a test.

Keep the PATH-stripping as the setup -- it is deterministic, costs no network, and dodges the ~2.05s Windows
refused-connect. It is the ASSERTION that has to stop reading the variant. And if you do end up needing the
spawn to be NotFound for some other reason, read spt_runtime::run_bounded_command first: it takes a command
TEMPLATE string, so how it splits and spawns is what decides PATH resolution, and a PATH probe from your shell
does not measure what that function spawns.

Credit where it is due: your --remote arm asserting the refusal line PRESENT is exactly the sibling probe that
makes the --via-subnet ABSENT assertion sound, and you wrote it without being asked. Keep that structure --
just point both arms at the attempt marker rather than the refusal text, and the pair stays sound on both boxes.