test: determinize hosted Windows lifecycle fixtures (#356)

[NOirBRight]

Summary

• replace the Hosted-sensitive PowerShell descendant fixture with a deterministic direct Python parent/child command using the existing bounded inspection runner and Win32 identity cleanup
• inject a test-only non-diagnostic start-command builder for the port-change restart fixture while retaining real Gateway health/listener and exact ownership assertions
• leave production process inspection, lifecycle budgets, diagnostics bootstrap, and fail-closed identity behavior unchanged

Refs #356

Verification (exact candidate c34c671)

• focused normal: both affected tests 10/10 consecutive repetitions
• focused debug (features debug-diagnostics): both affected tests 10/10 consecutive repetitions
• Rust normal: cargo test --locked -- --test-threads=1 — 532 passed, 0 failed, 1 ignored
• Rust debug: cargo test --locked --features debug-diagnostics -- --test-threads=1 — 531 passed, 0 failed, 1 ignored
• Clippy normal: cargo clippy --locked --all-targets -- -D warnings — passed
• Clippy debug: cargo clippy --locked --all-targets --features debug-diagnostics -- -D warnings — passed
• git diff --check and rustfmt --edition 2021 --check src-tauri/src/proxy.rs — passed

[NOirBRight]

Orchestrator exact-SHA review: PASS\n\nReviewed c34c671 on the Standards/Quality axis. The diff is confined to src-tauri/src/proxy.rs test-only seams; production process inspection, lifecycle budgets, health/listener checks, exact identity/ownership, and fail-closed behavior remain unchanged. Focused 10x normal/debug, full Rust normal/debug, Clippy, rustfmt, and diff hygiene evidence are recorded. Merge remains blocked until this exact head has a successful Hosted CI / gate.