Windows: window_control::toggle_pin blocks the TUI thread on the host terminal's message pump (SetWindowPos/ShowWindow cross-process)

[Hmbown]

Found while fixing #5919 (PR #5922). PinCmd::execute calls window_control::toggle_pin() (crates/tui/src/tui/window_control.rs), which resolves the host terminal window (GetConsoleWindow, else GetForegroundWindow, else an EnumWindows/toolhelp walk of the parent chain) and drives it with synchronous SetWindowPos / ShowWindow. That HWND belongs to another process, so those calls are delivered to its window thread and block until it pumps messages. On a headless CI window station nothing pumps, which is how two dispatch-everything tests hung for 600 s; on a real desktop a busy or hung terminal host would stall the TUI's own thread the same way.

#5922 only skips /pin in the Windows dispatch-smoke tests and adds a per-command watchdog. The product fix is here:

• Use SWP_ASYNCWINDOWPOS and ShowWindowAsync (or issue the calls from a dedicated thread with a bounded wait) so the TUI thread never blocks on another process's message pump.
• Keep the existing apply-verify-retry logic truthful under the async calls: verify the resulting window state after a bounded wait and report pinned/not pinned from what was observed, never from the request.
• Re-enable /pin in the Windows dispatch-smoke tests once the call cannot block.

Only checkable on windows-latest CI or a Windows host.

[Hmbown]

Verification status from 0.9.13 release prep on main (8cd5bf199): all three bullets are present in the tree.

• Async calls: toggle_pin (crates/tui/src/tui/window_control.rs) drives the foreign window with ShowWindowAsync + SWP_ASYNCWINDOWPOS (landed in f60280408b).
• Truthful verify under async: bounded wait_for observes (800 ms restore / 400 ms apply), two attempts, returns observed state, bails with "not observed before the deadline" otherwise.
• Coverage restored: skip_in_dispatch_smoke is restore-only (61868f39c1, "restore Windows pin dispatch smoke coverage"), with the headless-no-mailbox assertion so the smoke branch cannot mutate a real window.

Not verifiable from macOS: the Windows path does not cross-compile here (ring needs MSVC headers), so native acceptance is CI's Test (windows-latest) on 8cd5bf199 (run 34545532092, in progress at time of writing — both fix commits named that lane as the remaining acceptance). If that job is green, close this with that run as the receipt; if it names /pin, this issue is live again.