Windows: CLI output differential assumes a drive-root tmp directory #6809

Problem

On native Windows, examples/control_plane/cli-output-budget-regression-smoke.py can fail before producing base/head receipts because _stable_budget_fixture_root() in tests/control_plane/test_cli_output_budget.py hardcodes Path('/tmp'). Windows resolves that path on the current drive. A normal native temporary drive need not contain a root-level tmp directory; the differential runner changes its child working directory to the native temporary directory and hits FileNotFoundError during fixture.mkdir().

Observed on current main 860e42d4b63b45c4798ee7f08622a27c146a2610, native Windows, CPython 3.12.10. This is an actual source-canary failure, not inferred from static inspection. The same focused fixture tests can pass from a checkout drive that already has a root-level tmp, hiding the problem.

Minimal reproduction

On Windows with no root-level tmp on the native temporary drive:

uv sync --extra test
uv run --extra test python examples/control_plane/cli-output-budget-regression-smoke.py

The base probe raises FileNotFoundError in _stable_budget_fixture_root before the semantic differential executes. No system directory should have to be pre-created for a source smoke.

Acceptance and counterfactual already checked

The owning contract is the real-output, same-fixture base/head qualification in docs/reference/contracts/interface-budget-contract.md and the budget-failure decision guide in docs/development/testing-and-quality.md.

Replacing /tmp with an ordinary per-user native temporary directory is not a complete fix by itself. A temporary, private counterfactual using the same real small-scenario CLI workload reached the output checks and emitted 3,221 characters for start_goal_guided/small/markdown against its 3,200-character ceiling. Longer fixture paths affect the measured interface. No product instructions were shortened and no budget was changed.

A repair should:

• choose an owned physical fixture root that works on native Windows without modifying an unowned drive-root directory;
• preserve refusal to replace an existing fixture and cleanup of the owned fixture;
• run both base and candidate on matched fixture semantics, including the historical base probe;
• qualify actual native path and quoting costs before proposing any evidenced ceiling adjustment; preserve semantic anchors, complete commands and long-path coverage;
• retain the existing POSIX characterization and add native Windows regression coverage.

This is separate from #6405's already-fixed source launcher failures and #6556's fixed canary contract launcher. The observed runtime source is unchanged by #6805; that PR records this pre-existing canary limitation. No production output fix or successful full budget differential is claimed here.