fix(windows): close legacy and SSH teardown gaps

.github/workflows/windows-terminal-restart-e2e.yml

@@ -32,8 +32,12 @@ on:
       - 'src/main/providers/**'
       - 'src/main/pty/**'
       - 'src/preload/**'
+      - 'src/relay/**'
+      - 'src/renderer/src/components/terminal/**'
       - 'src/renderer/src/components/terminal-pane/**'
       - 'src/renderer/src/lib/pane-manager/**'
+      - 'src/renderer/src/store/slices/terminal*.ts'
+      - 'src/shared/pty-shutdown-safety.ts'
       - 'src/shared/pty-session-id-format.ts'
   workflow_dispatch:
     inputs:
@@ -82,8 +86,35 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Run real Windows SSH relay Job integration
+        shell: pwsh
+        run: |
+          node config/scripts/ensure-native-runtime.mjs --runtime=node
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          pnpm exec vitest run src/relay/windows-agent-job.integration.test.ts --config config/vitest.config.ts
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      - name: Verify generated node-pty projects retain Spectre mitigation
+        shell: pwsh
+        run: |
+          $projects = Get-ChildItem node_modules/node-pty/build -Recurse -Filter *.vcxproj
+          foreach ($target in @('conpty', 'conpty_console_list', 'winpty-agent', 'winpty')) {
+            $project = $projects | Where-Object BaseName -eq $target | Select-Object -First 1
+            if (-not $project) {
+              throw "Missing generated node-pty project: $target"
+            }
+            if (-not (Select-String -Path $project.FullName -Pattern '<SpectreMitigation>Spectre</SpectreMitigation>' -Quiet)) {
+              throw "Spectre mitigation missing from generated project: $($project.FullName)"
+            }
+          }
+
       - name: Build Electron app for Windows E2E
-        run: pnpm exec electron-vite build --mode e2e
+        shell: pwsh
+        run: |
+          node config/scripts/ensure-native-runtime.mjs --runtime=electron
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          pnpm exec electron-vite build --mode e2e
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Run patched node-pty failed-connect cleanup regressions
         env: