Run piped legacy Windows sandbox processes without a console (#49308)

## What changed

Use `ConsoleMode::NoWindow` for legacy Windows sandbox capture and non-TTY unified execution, enabling `CREATE_NO_WINDOW` for these piped processes.

## Testing

Extend the PowerShell interrupt and capture tests to assert that `GetConsoleWindow()` returns null before checking process termination and descendant survival.

GitOrigin-RevId: dcc3b5554986ab0280748e5fa7080d36ded3d673

codex-rs/windows-sandbox-rs/src/lib.rs

@@ -764,7 +764,7 @@ mod windows_impl {
                 &env_map,
                 logs_base_dir,
                 Some((in_r, out_w, err_w)),
-                ConsoleMode::Inherit,
+                ConsoleMode::NoWindow,
                 desktop,
             )
         });

codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs

@@ -115,7 +115,7 @@ fn spawn_legacy_process(
                 StdinMode::Closed
             },
             StderrMode::Separate,
-            ConsoleMode::Inherit,
+            ConsoleMode::NoWindow,
             launch_desktop,
             logs_base_dir,
         )?;

codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs

@@ -50,6 +50,8 @@ use windows_sys::Win32::System::Threading::WaitForSingleObject;
 static TEST_HOME_COUNTER: AtomicU64 = AtomicU64::new(0);
 static LEGACY_PROCESS_TEST_LOCK: Mutex<()> = Mutex::new(());
 
+const ASSERT_NO_CONSOLE: &str = r#"Add-Type -ErrorAction Stop 'using System; using System.Runtime.InteropServices; public class ConsoleProbe { [DllImport("kernel32.dll")] public static extern IntPtr GetConsoleWindow(); }'; if ([ConsoleProbe]::GetConsoleWindow() -ne [IntPtr]::Zero) { throw 'piped sandbox process unexpectedly has a console' };"#;
+
 fn legacy_process_test_guard() -> MutexGuard<'static, ()> {
     LEGACY_PROCESS_TEST_LOCK
         .lock()
@@ -460,7 +462,7 @@ fn legacy_non_tty_powershell_interrupt_terminates_process() {
                 pwsh.display().to_string(),
                 "-NoProfile".to_string(),
                 "-Command".to_string(),
-                "Write-Output LEGACY-NONTTY-DIRECT; [System.Threading.ManualResetEvent]::new($false).WaitOne()".to_string(),
+                format!("{ASSERT_NO_CONSOLE} Write-Output LEGACY-NONTTY-DIRECT; [System.Threading.ManualResetEvent]::new($false).WaitOne()"),
             ],
             cwd.as_path(),
             HashMap::new(),
@@ -681,7 +683,7 @@ fn legacy_capture_emits_output_and_preserves_descendant_after_normal_exit() {
         powershell_literal(&ready_marker),
     );
     let parent_command = format!(
-        "Write-Output LEGACY-CAPTURE-DIRECT; {}",
+        "{ASSERT_NO_CONSOLE} Write-Output LEGACY-CAPTURE-DIRECT; {}",
         start_powershell_child(&pwsh, codex_home.path(), &descendant_command, &parent_tail,),
     );
     let permission_profile = PermissionProfile::workspace_write();