fix(redteam): wire silent_subprocess into entry point, close red-team tails

[ManSio]

Closes the two leftovers from PR #56 report.

(a) silent_subprocess was INERT — wired into entry point (src/main.py import + apply() at startup, as the module docstring requires). Reference check: stash vor-fix-unstaged (stash@{2}) contains no src/main.py wiring, so implemented the minimal import+apply directly.

• Hardening found by the liveness test: apply() now guards TypeError for non-class Popen (conftest test-shims replace Popen with a plain function; without the guard the startup import would fail under pytest).
• Liveness proof: tests/test_silent_subprocess_wired.py spawns a fresh interpreter (immune to conftest shims), imports src.main, asserts _APPLIED + Popen=_SilentPopen on win32.

(b) KNOWN_ISSUES.md reconciled: 3x 2026-09-28 red-team entries (Open)/(Fixed-pending-verification) -> Fixed with fix SHA 0b6ca7c + merge e8811af (PR #56 CI all green). The 2026-09-28 retriever-cache methodology rule stays Open honestly (not a code fix).

Evidence: affected suites 13/13 green (silent 3 + wired 1 + hook 3 + holdout 6); full suite 1941 passed, 6 skipped; ruff check clean (format drift in touched files is pre-existing at HEAD, hunks are clean).
DO NOT MERGE — for owner review.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 0060bb61-31eb-46c1-9c49-99e344c405ef

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}