Tracked paths valid on Windows: the colon in a site-ui-3 screenshot name renamed; tools/ci/windows-paths-check.sh in CI

actions/checkout on windows-latest failed with "invalid path 'docs/plans/site-ui-3-shots/after/address_igneumdev:qz9h....jpg'" (git exit 128), so every Windows build of the tree died at the checkout.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -67,6 +67,8 @@ jobs:
         run: bash tools/ci/identity-check.sh
       - name: no conflict markers in tracked files
         run: bash tools/ci/no-conflict-markers.sh
+      - name: every tracked path is valid on Windows (tools/ci/windows-paths-check.sh)
+        run: bash tools/ci/windows-paths-check.sh
       - name: PowerShell drive-reference check (a `$name:` inside a double-quoted string is a 5.1 parse error)
         run: bash tools/ci/ps-drive-ref-check.sh
       - name: copied sources are re-stamped before a build

tools/ci/windows-paths-check.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Every tracked path must be one Windows can hold: no : * ? " < > | in a name, no name ending in a dot or a space.
+# 6 October 2026: docs/plans/site-ui-3-shots/after/address_igneumdev:qz9h....jpg (a colon from an address in a screenshot
+# name) made actions/checkout fail on windows-latest ("invalid path", git exit 128), and every Windows build of the tree
+# died at the checkout. Runs in CI (ubuntu, before any Windows job) and locally. Exit 1 with the paths listed.
+set -euo pipefail
+cd "$(git rev-parse --show-toplevel)"
+bad="$(git ls-files -z | tr '\0' '\n' | grep -E '[:*?"<>|]|[. ]$|(^|/)[^/]*[. ]/' || true)"
+if [ -n "$bad" ]; then echo "windows-paths: these tracked paths cannot exist on Windows (rename them):"; printf '%s\n' "$bad" | sed 's/^/  /'; exit 1; fi
+echo "windows-paths: every tracked path is valid on Windows ($(git ls-files | wc -l | tr -d ' ') files)"