Suppress Windows console windows for background subprocesses (#49164)

## Why

Background helpers launched from a detached Windows process can allocate console windows. Job Object launches and containment fallbacks need to preserve console suppression as well.

## What changed

- Add `codex_utils_process::background_command` to set `CREATE_NO_WINDOW` on Windows, and use it across background subprocess launches, including Git, plugins, authentication, diagnostics, and sandbox helpers.
- Centralize console suppression in Job Object launches. Keep `CREATE_NO_WINDOW` when retrying without containment, and clear `CREATE_SUSPENDED` so the fallback child can run.
- Preserve console inheritance for interactive shell launches and interactive AWS authentication refreshes.

## Testing

Add Windows regression tests covering console-free launches from detached parents through standard and Tokio commands, stdout/stderr capture, successful containment, Job Object creation and assignment failures, and sandbox setup refresh helpers.

GitOrigin-RevId: b2c238fa7d4f9fbd868e5adf7d4be9958ff01e6c

codex-rs/git-utils/Cargo.toml

@@ -9,6 +9,7 @@ readme = "README.md"
 workspace = true
 
 [dependencies]
+codex-utils-process = { workspace = true }
 anyhow = { workspace = true }
 chrono = { workspace = true }
 codex-file-system = { workspace = true }

codex-rs/git-utils/src/git_process.rs

@@ -41,16 +41,7 @@ fn spawn_git_command(command: &mut Command) -> Option<(Child, KillGitProcessTree
         .stderr(Stdio::piped());
 
     #[cfg(windows)]
-    let (child, job) = match JobObject::create()
-        .and_then(|job| job.spawn_contained(command).map(|child| (child, job)))
-    {
-        Ok((child, job)) => (child, Some(job)),
-        Err(_) => {
-            // A failed contained spawn leaves CREATE_SUSPENDED on the command.
-            command.creation_flags(0);
-            (command.spawn().ok()?, None)
-        }
-    };
+    let (child, job) = JobObject::spawn_background(command).ok()?;
     #[cfg(not(windows))]
     let child = command.spawn().ok()?;
 

codex-rs/git-utils/src/operations.rs

@@ -2,7 +2,6 @@ use std::ffi::OsStr;
 use std::ffi::OsString;
 use std::path::Path;
 use std::path::PathBuf;
-use std::process::Command;
 
 use codex_protocol::shell_environment::scrub_non_inheritable_env_vars;
 
@@ -130,7 +129,7 @@ where
         args_vec.push(OsString::from(arg.as_ref()));
     }
     let command_string = build_command_string(&args_vec);
-    let mut command = Command::new("git");
+    let mut command = codex_utils_process::background_command("git");
     command.current_dir(dir);
     if let Some(envs) = env {
         for (key, value) in envs {