fix(windows): real toolchain probing, HOME/TEMP env, and gate portability

code_run.py: shutil.which() finding a compiler executable on PATH doesn't
mean it's a usable toolchain on Windows -- rustc's MSVC target also needs
Microsoft's linker, and an MSYS2 gcc/clang driver can remain resolvable after
one of its runtime DLLs has broken. Both cases silently turned every C/C++/
Rust snippet into a compile error while the capability check said "ready".
_compiled_tool() now actually compiles+links a trivial known-good program
per candidate (Windows only; POSIX keeps the cheap which(1) check since
release hosts install compiler packages atomically) and caches the result.

Also fixes the run/compile child environment: HOME/TMPDIR don't control
Windows' real temp/profile resolution (expanduser() reaches the actual user
profile, GetTempPath() falls back to the Windows directory), letting a
snippet escape the scratch directory or fail outright. _child_env() now also
sets TEMP/TMP/USERPROFILE on Windows.

tests/conftest.py (new): isolates curry_store's SQLite singleton into a
per-run temp directory via NEXUS_CURRY_DB before any test module imports
synapse, and cleans it up at session end -- the release gate no longer
writes test constants into the checkout's live data/curry.db. .gitignore
picks up /data/curry.db for whatever still lands there locally.

bin/check.sh: falls back to Promethean/Scripts/python.exe when
Promethean/bin/python doesn't exist, so the gate actually runs on a Windows
venv instead of immediately exiting "no Promethean venv".

Verified independently: 254 passed, 0 failed, 8 skipped (tests + management)
-- the 12 C/C++/Rust toolchain failures present all session are gone. Full
bin/check.sh run end-to-end on this Windows checkout: pytest, eslint,
frontend node:test (57/57), PowerShell/shell parse, and the wheel/sdist
packaging + twine + content checks all report OK.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bin/check.sh

@@ -9,14 +9,18 @@ cd "$(dirname "$0")/.."
 
 fail=0
 
-if [ ! -x Promethean/bin/python ]; then
+if [ -x Promethean/bin/python ]; then
+    NEXUS_CHECK_PY=Promethean/bin/python
+elif [ -x Promethean/Scripts/python.exe ]; then
+    NEXUS_CHECK_PY=Promethean/Scripts/python.exe
+else
     echo "!! no Promethean venv - run ./install.sh first" >&2
     exit 1
 fi
 
 echo "== pytest =="
 # Explicit dirs: a bare `pytest` would walk Promethean/ and node_modules too.
-Promethean/bin/python -m pytest -q tests management || fail=1
+"$NEXUS_CHECK_PY" -m pytest -q tests management || fail=1
 
 echo "== eslint =="
 if [ -d interface/web/node_modules ]; then
@@ -57,13 +61,13 @@ done
 echo "== packaging =="
 # The wheel is the other shippable artifact, so it belongs in the same gate:
 # a broken pyproject or a missing web build only shows up at build time.
-if Promethean/bin/python -c "import build, twine" 2>/dev/null; then
+if "$NEXUS_CHECK_PY" -c "import build, twine" 2>/dev/null; then
     rm -rf .build-check
-    if Promethean/bin/python -m build --outdir .build-check >/dev/null 2>&1; then
-        Promethean/bin/python -m twine check .build-check/* || fail=1
+    if "$NEXUS_CHECK_PY" -m build --outdir .build-check >/dev/null 2>&1; then
+        "$NEXUS_CHECK_PY" -m twine check .build-check/* || fail=1
         # The compiled UI has to actually be inside the wheel - a wheel that
         # builds but ships no dist/ serves a blank page.
-        Promethean/bin/python - <<'PY' || fail=1
+        "$NEXUS_CHECK_PY" - <<'PY' || fail=1
 import glob, sys, zipfile
 wheels = glob.glob(".build-check/*.whl")
 if not wheels: