fix(windows): harden runner process-tree shutdown

[jmagar]

Summary

• replace raw Windows Job Object handles with exclusive RAII ownership and explicit close errors
• fail Code Mode runner startup closed when containment cannot be armed, with deterministic direct-child cleanup
• aggregate and report runner/process-tree shutdown failures across Code Mode and gateway lifecycle paths
• add Windows containment success and assignment-failure coverage

Review provenance

Follow-up to #474 after the requested comprehensive review surfaced Windows process-lifecycle gaps. Tracks lab-ryvkj.

Verification

• cargo test -p labby-codemode --lib
• cargo test -p labby-gateway upstream::process_guard
• cargo clippy -p labby-codemode -p labby-gateway -p labby-winjob --all-targets --all-features -- -D warnings
• RUSTFLAGS="-D warnings" cargo check --target x86_64-pc-windows-gnu -p labby-codemode --all-targets
• RUSTFLAGS="-D warnings" cargo check --target x86_64-pc-windows-gnu -p labby-winjob -p labby-gateway
• cargo fmt --all -- --check
• git diff --check

Residual boundary

The Windows lifecycle tests compile locally through the GNU cross-target; actual Windows runtime execution is delegated to CI.