fix(symbols): annotate c++filt direct spawn for find_direct_subprocess.py

PR #424's "Lint subprocess spawns" CI runs both a dylint rule (file-
level allowlist, already added) AND a separate Python script
`ci/find_direct_subprocess.py` that scans for `Command::new(...)` and
requires an inline `// allow-direct-spawn: <reason>` comment on the
line above each call. The dylint allowlist alone is not enough — both
gates must pass independently.

Add the inline annotation above the c++filt spawn in
`fbuild-build::symbol_analyzer::demangle_batch` matching the format
used elsewhere in the tree (see e.g. fbuild-cli/src/daemon_client.rs).
Same rationale as the dylint allowlist entry: stdin-piped + threaded
writer is required to avoid the Windows pipe-buffer deadlock when
demangling thousands of names.

Author: zackees

crates/fbuild-build/src/symbol_analyzer.rs

@@ -73,6 +73,12 @@ pub fn demangle_batch(mangled: &[String], cppfilt_path: &Path) -> Result<Vec<Str
     }
     let stdin_data = mangled.join("\n");
 
+    // allow-direct-spawn: c++filt demangler. The captured `run_command`
+    // helper is stdin-Null; we need to pipe the mangled-symbol list
+    // through c++filt's stdin and concurrently drain stdout via
+    // wait_with_output to avoid the Windows pipe-buffer deadlock when
+    // the symbol pool is large (~3k symbols on a stock ESP32-S3 Blink
+    // ELF). Read-only analysis path; no containment side effects.
     let mut child = Command::new(cppfilt_path)
         .stdin(Stdio::piped())
         .stdout(Stdio::piped())