Follow-up to HOST-001 (#187, merged). An audit of the merged code surfaced two live bugs and a structural CI gap.

Bugs (live in master)

BUG-A — bool flags break the flags > env > defaults chain. applyFlags in internal/host/config.go did cfg.NoSleep = flags.NoSleep / cfg.Verbose = flags.Verbose unconditionally. Cobra defaults a bool flag to false, so when the user does NOT pass --no-sleep, an unset flag overwrites a real TS_HOST_NO_SLEEP=true from .env/env. Effect: env-configured no-sleep/verbose are silently ignored unless the flag is also passed. (CodeRabbit flagged this as Major on #187; it was not fixed before merge.)

I3 — Windows host setup reports the requested --port, not the configured one. On Windows the RDP listening port comes from the registry; the firewall opens that port, but the summary and --json output printed cfg.Port (the requested value). A user passing --port 4000 saw 4000 reported while the firewall actually opened the registry port.

CI gap (root cause of the original C1)

The Linux test job does not compile //go:build windows files, so a Windows-only build break passes every check. There is no native Windows runner — only cross-compilation in build-matrix. This is exactly how the HOST-001 Windows build break reached CI.

Plan

• BUG-A: add NoSleepSet/VerboseSet to host.Flags, populate from cmd.Flags().Changed(...), guard in applyFlags; add a precedence regression test.
• I3: report result.RDPPort (actual) in the setup summary and JSON; warn on Windows when an explicit --port differs from the configured port.
• CI: add a test-windows job (build + vet + test) on windows-latest.
• Un-skip TestWriteHostEnv_FilePermissions on non-Windows so the 0600 write is verified on CI.
• Strengthen smoke.ps1 to assert host --help lists init.

Acceptance criteria

• Unset --no-sleep/--verbose no longer override env; explicit flags still win (test proves both)
• Setup summary/JSON report the actually-configured RDP port; Windows --port mismatch warns
• test-windows job runs build + vet + test on Windows in CI
• TestWriteHostEnv_FilePermissions runs (not skipped) on Linux CI
• gofmt/vet/lint clean; no new go.mod entries