fix: harden workspace preprocessing contract

tools/thothctl/internal/compose/process_windows_test.go

@@ -0,0 +1,23 @@
+//go:build windows
+
+package compose
+
+import (
+	"golang.org/x/sys/windows"
+	"os/exec"
+	"testing"
+)
+
+func TestOwnedProcessConfigurationStartsSuspended(t *testing.T) {
+	cmd := exec.Command("cmd.exe")
+	configureOwnedProcess(cmd)
+	if cmd.SysProcAttr == nil || cmd.SysProcAttr.CreationFlags&windows.CREATE_SUSPENDED == 0 {
+		t.Fatal("owned Windows process must start suspended until job assignment")
+	}
+}
+
+func TestOwnedJobPolicyKillsDescendantsOnClose(t *testing.T) {
+	if windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE == 0 {
+		t.Fatal("owned job must use kill-on-close policy")
+	}
+}