tests: 3 more Windows fixes — pnpm ignore-scripts, security_controls brew, uv tool shim

- test_pnpmprovider.py::test_install_args_win_for_ignore_scripts_and_min_release_age:
  same pattern as npm/bun — Windows .cmd wrappers return 0 for the
  --ignore-scripts postinstall-missing case but emit the is not
  recognized error to stderr. Accept either signal.
- test_security_controls.py::test_nullable_provider_security_fields_resolve_before_handlers_run:
  skip the BrewProvider leg on Windows (brew is in
  UNIX_ONLY_PROVIDER_NAMES there and its INSTALLER_BINARY lookup
  raises BinProviderUnavailableError on hosts without brew, which
  is unrelated to what this security-field test is verifying).
- test_uvprovider.py::test_global_tool_mode_can_load_and_uninstall_without_bin_shim:
  hardcoded tool_bin_dir / 'cowsay' misses the Windows
  cowsay.exe shim. Resolve via bin_abspath which honors
  PATHEXT so both POSIX and Windows layouts match.

Author: claude

tests/test_pnpmprovider.py

@@ -36,8 +36,12 @@ def test_install_args_win_for_ignore_scripts_and_min_release_age(self):
             assert installed.loaded_abspath.exists()
             # The wrapper exists but the postinstall download was skipped via
             # explicit --ignore-scripts, so the vendored binary is missing.
+            # POSIX shells propagate the failing vendor binary's exit code;
+            # Windows ``.cmd`` wrappers return 0 but emit the ``is not
+            # recognized`` error to stderr — accept either as proof the
+            # postinstall was skipped.
             proc = installed.exec(cmd=("--version",), quiet=True)
-            assert proc.returncode != 0
+            assert proc.returncode != 0 or "not recognized" in (proc.stderr or "")
             # The provider's strict 100-year min_release_age was overridden
             # by the explicit --config.minimumReleaseAge=0 in install_args,
             # so the resolver was able to pick a real version.

tests/test_security_controls.py

@@ -14,6 +14,7 @@
     SemVer,
 )
 from abxpkg.exceptions import BinaryInstallError, BinaryLoadError
+from abxpkg.windows_compat import IS_WINDOWS
 
 
 class TestSecurityControls:
@@ -147,10 +148,15 @@ def test_nullable_provider_security_fields_resolve_before_handlers_run(self):
                 ).install("zx", no_cache=True)
                 is not None
             )
-            assert (
-                BrewProvider(
-                    dry_run=True,
-                    postinstall_scripts=None,
-                ).install("node", no_cache=True)
-                is not None
-            )
+            # Brew is in UNIX_ONLY_PROVIDER_NAMES on Windows — its
+            # ``INSTALLER_BINARY`` lookup raises
+            # ``BinProviderUnavailableError`` on hosts without ``brew``,
+            # which is exactly what this test is not verifying.
+            if not IS_WINDOWS:
+                assert (
+                    BrewProvider(
+                        dry_run=True,
+                        postinstall_scripts=None,
+                    ).install("node", no_cache=True)
+                    is not None
+                )

tests/test_uvprovider.py

@@ -571,8 +571,13 @@ def test_global_tool_mode_can_load_and_uninstall_without_bin_shim(
                     assert_version_command=False,
                 )
                 assert installed is not None
-                shim_path = tool_bin_dir / "cowsay"
-                assert shim_path.exists()
+                # POSIX writes ``bin_dir/cowsay`` while Windows writes
+                # ``bin_dir/cowsay.exe`` — resolve the actual shim via
+                # ``bin_abspath`` (PATHEXT-aware) so both layouts match.
+                from abxpkg.base_types import bin_abspath as _ba
+
+                shim_path = _ba("cowsay", PATH=str(tool_bin_dir))
+                assert shim_path is not None and shim_path.exists()
                 shim_path.unlink()
 
                 reloaded = provider.load("cowsay", quiet=True, no_cache=True)