fix: use WindowStyle=Hidden instead of NoNewWindow in headless scanner dispatch

NoNewWindow caused scanner processes to inherit PowerShell's stdout/stderr
pipe handles from the GuruRMM agent. If any scanner hung in Session 0
(e.g. AdwCleaner GUI init), it held the pipe open after PowerShell exited,
blocking the GuruRMM command for hours until the server-side reaper fired.

WindowStyle=Hidden gives each scanner its own window/console so pipe
handles are not inherited. Scanner processes that timeout are still killed
by Wait-ProcessWithTimeout; the overall scan completes normally.

Verified: full pipeline completes in ~7.5 min on RMM-TEST-MACHINE with
EICAR detection, GURUSCAN_RESULT_JSON emitted correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

projects/msp-tools/guru-scan/GuruScan.psm1

@@ -531,9 +531,16 @@ function Invoke-ScanPass {
 
         try {
             $startParams = @{
-                FilePath    = $launchExe
+                FilePath = $launchExe
-                PassThru    = $true
+                PassThru = $true
-                NoNewWindow = [bool]$Headless
+            }
+            # Use WindowStyle=Hidden (not NoNewWindow) so scanner processes get
+            # their own window/console and do NOT inherit the PowerShell pipe
+            # handles. With NoNewWindow the child shares the parent console and
+            # inherits its stdout/stderr pipes; if a scanner hangs the pipe stays
+            # open after PowerShell exits, blocking the GuruRMM agent for hours.
+            if ($Headless) {
+                $startParams['WindowStyle'] = 'Hidden'
             }
             if ($expandedArgs -and $expandedArgs.Count -gt 0) {
                 $startParams['ArgumentList'] = $expandedArgs