core/tools+test: make process and path checks Windows-portable

Use sys.executable for process tests; normalize denylist/glob paths; skip readline when missing.

src/plyngent/cli/slash.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import os
 import shlex
 from typing import TYPE_CHECKING, Any, cast, override
 
@@ -835,7 +836,8 @@ async def handle_slash(state: ReplState, line: str) -> bool:
     if not body:
         return True
     try:
-        args = shlex.split(body)
+        # Windows paths use backslashes; POSIX shlex would treat them as escapes.
+        args = shlex.split(body, posix=os.name != "nt")
     except ValueError as exc:
         click.echo(f"error: {exc}")
         return True

src/plyngent/tools/file/glob_paths.py

@@ -14,9 +14,9 @@ DEFAULT_MAX_MATCHES = 200
 
 def _rel(path: Path, root: Path) -> str:
     try:
-        return str(path.relative_to(root))
+        return path.relative_to(root).as_posix()
     except ValueError:
-        return str(path)
+        return path.as_posix()
 
 
 def _hidden_or_vcs(parts: tuple[str, ...]) -> bool:

src/plyngent/tools/workspace.py

@@ -94,9 +94,10 @@ def resolve_path(path: str | Path) -> Path:
     except ValueError as exc:
         msg = f"path escapes workspace root ({root}): {path}"
         raise WorkspaceError(msg) from exc
-    resolved_str = str(resolved)
+    # Normalize separators so denylist entries like ``/secrets/`` match on Windows.
+    resolved_str = str(resolved).replace("\\", "/")
     for pattern in _state.path_denylist:
-        if pattern and pattern in resolved_str:
+        if pattern and pattern.replace("\\", "/") in resolved_str:
             msg = f"path denied by policy (matched {pattern!r}): {path}"
             raise WorkspaceError(msg)
     return resolved