ci: add Git usr/bin to PATH on Windows (#25939)

## Summary

Fixes all 9 Windows CI test failures caused by the mise CI refactor
(`fe257666d7`, PR #25727).

### Root cause

`jdx/mise-action` exports `Path` (Windows convention) via `GITHUB_ENV`.
Bash on Windows maintains its own `PATH`. When Go's `os.Environ()`
returns both, `cmd.exe` subprocesses non-deterministically pick the
MSYS-translated `PATH` (forward slashes), causing Windows executables
(`printf`, `powershell.exe`, `cmd.exe`) to be unresolvable.

These failures only appeared on `main` (where `-count=1` forces real
test execution) and were masked on PRs by Go test cache.

### Fixes applied

**CI (`setup-mise` action)**:
- Write both `Path` and `PATH` to `GITHUB_ENV` with Git usr/bin
prepended

**Code (`cli/root.go`)**:
- Add `appendAndDedupEnv` helper that deduplicates case-insensitive env
vars on Windows, preferring native Windows paths (backslashes) over MSYS
paths

**Code (`cli/configssh_windows.go`)**:
- Use absolute paths for `powershell.exe` and `cmd.exe` in the SSH
config `Match exec` escape function, avoiding PATH resolution entirely

**Tests**:
- Switch `--header-command` tests from `printf` to `echo` (cmd.exe
builtin) for reliable cross-platform execution
- Add env dedup in `Test_sshConfigMatchExecEscape` for subprocess PATH
consistency

Fixes coder/internal#1556, coder/internal#1558, coder/internal#1559

> 🤖 Generated by Coder agent, will be reviewed by @mafredri. 🏂🏻

cli/root.go

@@ -1701,7 +1701,44 @@ func (r roundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	return r(req)
 }
 
-// HeaderTransport creates a new transport that executes `--header-command`
+// appendAndDedupEnv appends extra environment variables and
+// deduplicates entries with the same key (case-insensitive on
+// Windows). For the PATH variable specifically, it prefers the
+// value that contains native Windows paths (with backslashes)
+// over MSYS-translated paths (with forward slashes). For all
+// other variables, the last value wins.
+func appendAndDedupEnv(env []string, extra ...string) []string {
+	env = append(env, extra...)
+	if runtime.GOOS != "windows" {
+		return env
+	}
+	seen := make(map[string]int, len(env))
+	result := make([]string, 0, len(env))
+	for _, e := range env {
+		key, val, ok := strings.Cut(e, "=")
+		if !ok {
+			result = append(result, e)
+			continue
+		}
+		upper := strings.ToUpper(key)
+		if idx, exists := seen[upper]; exists {
+			if upper == "PATH" {
+				// Prefer the value with native Windows paths.
+				existingVal := result[idx][len(key)+1:]
+				if strings.Contains(existingVal, "\\") && !strings.Contains(val, "\\") {
+					continue
+				}
+			}
+			result[idx] = e
+			continue
+		}
+		seen[upper] = len(result)
+		result = append(result, e)
+	}
+	return result
+}
+
+// headerTransport creates a new transport that executes `--header-command`
 // if it is set to add headers for all outbound requests.
 func headerTransport(ctx context.Context, serverURL *url.URL, header []string, headerCommand string) (*codersdk.HeaderTransport, error) {
 	transport := &codersdk.HeaderTransport{
@@ -1719,7 +1756,7 @@ func headerTransport(ctx context.Context, serverURL *url.URL, header []string, h
 		var outBuf bytes.Buffer
 		// #nosec
 		cmd := exec.CommandContext(ctx, shell, caller, headerCommand)
-		cmd.Env = append(os.Environ(), "CODER_URL="+serverURL.String())
+		cmd.Env = appendAndDedupEnv(os.Environ(), "CODER_URL="+serverURL.String())
 		cmd.Stdout = &outBuf
 		cmd.Stderr = io.Discard
 		err := cmd.Run()