Cross-platform compat: Windows 11 + non-UTF-8 locales (incl. Korean cp949)

[sp3arm4n]

Summary

• Pin encoding=\"utf-8\" on every external-tool subprocess (apktool / jadx / Ghidra / Frida) so stdout/stderr decoding doesn't crash under Windows cp949/cp1252 or non-UTF-8 POSIX locales. Frida log is also written as utf-8.
• Cross-platform test stub helper at sample/tests/_subproc_stub.py. Replaces the #!/bin/sh stub scripts that previously crashed Windows tests with WinError 193. On POSIX it returns a shebang Python script with the exec bit; on Windows it returns a .cmd shim that delegates to the same Python via sys.executable. All inline shell-stub fixtures across test_apk_decoder, test_jadx_runner, test_android_pipeline, and test_cli_android_audit migrated to the helper.
• test_pipeline.py: python3 → sys.executable (no python3 alias on Windows).
• test_cli_android_audit.py: pin utf-8 when reading bundled poc .sh files (was crashing on cp949 default).
• .gitignore: broaden venv/ to also cover sibling per-platform virtualenvs (venv-*/).
• Bundled in: pre-existing fix multi so analysis fallback commit on the branch.

Test plan

• Windows 11 / Python 3.11.8: python -m unittest discover -s sample/tests → 805/805 pass (16 env-dependent skipped). Pre-fix run was 27 errors.
• End-to-end CLI under a Korean output path: venomhook offset-e2e --static-json sample/examples/static_meta.sample.json --target 샘플.exe --out-dir out_win/한글_경로_테스트 produces the expected venomhook.{json,db,md,js} artifacts.
• All changes guarded by os.name == \"nt\" branches or are strictly utf-8-additive — POSIX behavior unchanged.
• macOS M2 / Ubuntu 24.04 / Kali: not run on this machine. Pattern is safe (POSIX path uses shebang #!{sys.executable} + chmod +x, identical to existing test stubs), but a fresh python -m unittest discover -s sample/tests on each target OS before merge would close the loop.
• Live external tools: only stub-level coverage in CI. Real apktool/jadx/Ghidra/Frida i18n stdout was not exercised; the encoding fix is the right direction but worth a real-tool sanity run on Windows.

Out of scope

• Windows long-path (>260 chars) handling — not changed; relies on Python 3.11's default behavior + Windows long-path opt-in.
• .claude/skills/... and other unrelated working-tree changes — left untouched.

🤖 Generated with Claude Code