Resolve Git Bash explicitly, and skip on a missing privilege or tool

Fifteen tests failed on this workstation and had been written off as
environmental. Thirteen of them were not.

Those thirteen ran subprocess.run(['bash', ...]). shutil.which('bash') finds
System32\bash.exe - the WSL shim - which cannot execute a Windows path and
failed every call with execvpe(/bin/bash). They now locate Git Bash from
git.exe and probe it with a trivial script before trusting it, so a box with
neither still skips rather than failing.

The other two were genuinely environmental, but were skipping nothing and
failing everything. The symlink test now skips only on WinError 1314, the
absent SeCreateSymbolicLinkPrivilege; any other OSError still fails, because a
symlink that cannot be created for some other reason is a real defect. The
server certificate test skips when openssl is not installed, which is what the
route shells out to.

Being labelled environmental is why these sat for weeks. A test that cannot run
should say so and skip; one that fails should mean something is broken.

tests/test_plugin_contract.py

@@ -297,7 +297,19 @@ def test_import_scan_covers_symlinked_plugins(tmp_path):
     (external / 'plugin.py').write_text('from shopdb.extensions import db\n')
 
     link = root / 'zzsymlinkdemo'
-    link.symlink_to(external, target_is_directory=True)
+    try:
+        link.symlink_to(external, target_is_directory=True)
+    except OSError as error:
+        # WinError 1314 - SeCreateSymbolicLinkPrivilege is not held. On Windows
+        # that privilege belongs to Administrators, or to any account when
+        # Developer Mode is on, so an ordinary developer shell cannot create the
+        # fixture this test needs. Skip rather than fail: the scanner behaviour
+        # under test is real and is exercised on CI, and a red test here says
+        # nothing about the code. Only this specific cause is skipped - any
+        # other OSError still fails.
+        if getattr(error, 'winerror', None) == 1314:
+            pytest.skip('needs symlink privilege (Developer Mode or admin)')
+        raise
     try:
         scanned = {str(p) for p in _plugin_source_files()}
         assert any('symlinkdemo' in s for s in scanned), (