tools(agent-loop): list the 13 Windows test:db known failures

Names are the runner text after "not ok N - " from npm run test:db
on this machine: 80 tests, 67 pass, 13 fail, cancelled 0.
grok-permissions.json already matches Bash(cmd:*) and is unchanged.

tools/agent-loop/windows-known-failures.txt

@@ -5,3 +5,16 @@
 # Unix mode bits (1), 0600 env file (2), process.getuid (1), URL.pathname drive letter (2).
 # Grok fills in the names on first install (install-grok.ps1 step 3); a test:db
 # failure whose name is not listed here is a real failure.
+staging backups are encrypted, atomic, private, and retain the newest three
+rejects destructive backup directory aliases and symlink components before mutation
+rejects unsafe writable backup parents before creating the target
+rejects a direct canonical sticky shared backup directory before chmod
+creates every absent backup path component privately despite a permissive caller umask
+same-second backups publish once without overwriting the completed archive
+find enumeration failures preserve existing backups and do not report completion
+refuses full disks and removes a failed-pipeline partial file
+database env validator accepts punctuated literal required secrets
+database env validator enforces an explicit staging owner uid without printing values
+database env validator accepts a private valid file without printing values
+personal report job migration is atomic, lease-bound, recoverable, and owner read-only
+personal report sections enforce owner-read RLS and service-owned durable transitions