Fix Windows source header checks

[ryanduguid]

Summary

Make the source-header checker work on native Windows by reading UTF-8 explicitly and accepting slash-based relative headings. Existing native-path and basename headings remain valid; both validation regexes and the read limit are unchanged. The regression tests skip site startup hooks in their standard-library-only subprocess so pytest-cov cannot start unwanted child coverage from the temporary working directory.

accepted heading = native relative path | slash-based relative path | basename

Evidence

• Before: Python 3.8 with UTF-8 mode disabled raises UnicodeDecodeError under cp1252. With UTF-8 enabled, the complete checker instead reports 15 incorrect-identification errors in updater scripts.
• After: The complete checker passes on Windows Python 3.8 and 3.14 with UTF-8 mode disabled and enabled, and on Linux Python 3.14.
• Eight test methods run ten fixture subprocesses covering Unicode content, portable/native/basename headings, invalid identification or licence text, and both errors together. They pass on Windows CPython 3.8 through 3.14. Four independent negative controls on native 3.8/3.14 still detect each original defect while retaining -S.
• Full suites pass 421 tests with nine conditional skips on Windows 3.8/3.14 and Linux 3.8/3.14. The configured stdnum branch-coverage gate remains 100%; it does not measure the subprocess checker.
• The initial Linux Python 3.8 CI job passed all tests, then failed coverage combination. The published version reproduces that error locally with Python 3.8.18, pytest 8.3.5, pytest-cov 5.0.0 and coverage 7.6.1. Adding -S to the checker subprocess fixes the full suite without changing coverage configuration or its threshold.
• Fresh full Linux lint, Windows strict typing and ordinary-startup header checks pass. Windows full flake8 passes with UTF-8 enabled; changed-file flake8 also passes with UTF-8 mode disabled. Earlier Linux docs and library typing results remain valid because their inputs are unchanged.
• All 14 upstream checks pass on repaired commit d2a8d5206731c9ba72b4d6ef2c9e5858d45f3065, including Linux CPython 3.8 through 3.14 and PyPy 3.9.

Merge danger

Door: two-way. Blast radius: contributor checks.

The file scan and licence policy stay the same. UTF-8 decoding remains strict, and native diagnostic paths are preserved. No dependency or library validator changes.

Unverified

macOS, PyPy and the remaining Linux interpreter matrix were not tested locally.

The default Windows flake8 run still encounters the pre-existing cp1252 decoding failure; this change repairs the separate header script. The new tests invoke the checker directly and do not create scripts/__pycache__, which the existing glob would try to read as a file.