feat(proxy): add crash-safe recovery watchdog

[kev1n77]

Summary

• add a transactional proxy snapshot journal and independent watchdog process
• require a watchdog ready handshake before applying proxy changes
• restore on normal shutdown, owner-process pipe EOF, or next-startup repair
• lock the armed snapshot in watchdog memory so journal tampering cannot redirect recovery writes
• use atomic Windows journal replacement and deterministic file-backend fault injection
• keep SPIKE-003 in progress until real Windows/macOS proxy backends are verified

Verification

• cargo fmt --all -- --check
• cargo test --workspace --all-targets (20 passed)
• cargo clippy --workspace --all-targets -- -D warnings

Recovery tests cover normal restore, force-killed owner recovery, startup repair, and post-arm journal tampering. No watchdog processes remain after the suite.