fix(runtime): harden host-death watchdog identity

[dilatedtime]

What changed

The OOP runtime now treats its host watchdog as a process-identity boundary rather than only a PID lookup:

• resolve the host inside the watchdog's fail-open guard, so an environment/process-table exception does not abort a healthy plugin startup
• reject a live process that acquired BOSS_HOST_PID after this child JVM started; that temporal ordering detects PID reuse without changing the host protocol
• preserve compatibility when start metadata is unavailable, and accept equal instants for coarse platform clocks
• treat a blank BOSS_HOST_PID as unset while retaining warnings for malformed non-blank/self-PID declarations
• keep a declared dead, missing, or recycled host authoritative instead of falling back to an unrelated OS parent
• isolate the lifecycle code in HostDeathWatchdog.kt and document the intentional Runtime.halt/POSIX-zombie boundaries
• replace the sh-only non-child fixture with a JDK-only launcher, so the same real ProcessHandle.onExit() path runs on Windows, macOS, and Linux

User impact

A plugin child can no longer attach its lifetime to an unrelated process after rapid PID reuse and then survive indefinitely after BOSS is gone. At the same time, an unavailable optional process API no longer prevents an otherwise healthy plugin from starting. The Windows suite now exercises the watchdog instead of failing before it reaches the behavior under test.

Validation

• Before: HostDeathWatchdogTest on Windows — 13 tests, 7 failures (sh unavailable plus pid-1 assumptions)
• After: focused watchdog suite — 20/20 passed
• Full repository suite — 263 tests, 0 failures, 0 skipped
• CI=true ./gradlew build fatJar — passed
• packaged fat JAR inspected for both HostDeathWatchdogKt.class and PluginProcessMainKt.class
• mutation check — four independent regressions were each caught: swallowing VM errors, falling back after dead/missing declared hosts, and accepting a recycled PID
• git diff --check — clean

Compatibility and scope

No IPC, manifest, dependency, version, or host-side change is required. Missing start-time metadata deliberately keeps the existing PID-only behavior. PR #21 also adjusts the old Windows test launcher; its production changes are disjoint, and this JDK-only fixture removes the shell dependency entirely.

Closes #14