Tests run on Windows and macOS only when a release tag is pushed #962

ci.yml and nightly.yml run on ubuntu-latest only. The Windows and macOS matrix is publish.yml's cross-os-tests job, which runs when a release tag is pushed. A change that breaks a test on Windows or macOS therefore merges green and surfaces at release time, where it blocks the PyPI publish.

#954 met this twice. Its guard tests created symlinks unconditionally, which Windows allows only with a privilege or developer mode, and its bash comparison would have run under Windows' Git Bash, whose environment differs. Both were found by running the tests by hand on a throwaway branch.

Acceptance criteria

• The tests that depend on the operating system (paths, shells, the filesystem: tests/test_check_*.py, tests/test_guard_wiring.py and similar) run on windows-latest and macos-latest before a release tag: nightly, or on pull requests that change tools/ or tests/.
• A failure there is visible without waiting for a release, like the nightly job's existing failure issue.