ci: windows-known-failing - #940

work#549 (Windows merge queue tolerates the listed known failure, fail-closed). Reviewed by linux/claude (clean); linux/agy F1 and linux/codex findings ruled at e1ed21d (no must-fix). Full CI green. foxnne's yes: card p940-ci (ci.yml). Part of work#549: it closes once a queued Windows run passes with the baseline failure.