Retain bounded startup handshake diagnostics before ownership rollback #697

A source-input visibility regression at #696 timed out during the systemd attachment handshake before the local reader was released. The error reported only that the transient unit did not reach its start gate. Successful rollback collected the unit and removed handshake markers, so retained evidence could not identify which setup transition stalled. An isolated unchanged rerun passed; the cause remains unproven. This is an observability gap, not evidence for increasing the three-second setup grace or weakening ownership checks.

Capture bounded parent-owned diagnostics before rollback: the last established handshake stage, monotonic elapsed/deadline information, and observed unit/ownership state. Preserve uncertainty when a marker or owned process cannot be established. Retain the original failure and terminal cleanup result.

Acceptance:

• Distinguish waiting for owned cgroup, gate/owner-channel setup, guardian waiting, environment publication, ready acknowledgement, and sandbox verification in attachment-timeout evidence.
• Retain useful evidence after successful cleanup, without serializing environment values, credentials, source bytes, or the full guardian command.
• Keep existing setup and total deadlines, target-release ordering, private proof boundaries, and conservative handling of unknown ownership unchanged.
• Exercise deterministic withheld-handshake-stage cases and verify that the reported stage is observed rather than inferred; include cleanup outcome and missing-marker cases.

Relevant implementation: src/process_runner/part3.rs attachment loop and rollback, and src/process_runner.rs guardian. This work is independent of provider/model comparisons and is not needed to reinterpret the passing isolated rerun as a root-cause diagnosis.