check-windows-portability's /WX assertion is satisfied by /WX-, so the gate is blind to its own inversion

[localai-bot]

What

scripts/check-windows-portability.py:1710 asserts the MSVC warning policy with a substring test:

if not all(token in warnings for token in ("/W4", "/WX")):
    errors.append("CMakeLists.txt: MSVC /W4 /WX policy is required")

"/WX" in "/WX-" is True. /WX- is MSVC's spelling for disable warnings-as-errors — the exact inversion of the policy this line exists to enforce.

Demonstrated

Run against both trees during the review of PR #640, which downgrades /WX → /WX-:

BASE (main):
  checker '/W4 /WX policy' assertion passes : True
  file actually contains /WX- (disable)     : False
PR 640:
  checker '/W4 /WX policy' assertion passes : True
  file actually contains /WX- (disable)     : True

The gate passes identically either way.

Why it is worse than it looks

In that PR the only bare /WX surviving was the one added for $<COMPILE_LANGUAGE:OBJCXX> — Objective-C++, i.e. the Metal backend, which never compiles under MSVC. So the policy assertion was satisfied by an inert token on a language Windows does not build, while the arm that matters got /WX-.

AGENTS.md forbids turning a red gate green by widening a scope. This checker cannot detect that being done to it.

Fix

Match on token boundaries rather than substrings — e.g. split the flag string and compare exact tokens, or require a /WX not followed by -. And assert the policy on the flags that reach the C/C++ compile, not merely somewhere in the file, so an OBJCXX-only occurrence cannot satisfy it.

Per AGENTS.md this is a checker-semantics change: spec, red-before test (a /WX- tree must go RED), green-after evidence.

Found while reviewing PR #640.