fix(ssh): launch Windows Bun relays outside the SSH session job

[OrcaWin]

ELI5

Windows SSH terminals must keep running after the SSH connection closes. On a standard-user ARM Windows host, the existing WMI launcher was refused before the relay could start. This change starts the bundled Bun relay directly and lets it survive the SSH session.

What Changed

The relay accepts a launch-only flag, creates its daemon outside the SSH session's Windows job, and returns the daemon PID. It inherits only NUL input and its two append-only log handles. Arguments stay as arguments, terminal PATH stays unchanged, and launch errors include a best-effort Windows error hint.

The client sends the flag to its matching content-hashed relay installation. Existing daemon reconnects and non-Windows launches retain their existing paths.

Why

Ordinary detached child creation does not request Windows job breakaway. WMI introduced a separate permission requirement; using the Windows process API directly removes that requirement without introducing a shell or a second launch fallback.

Linked Issue

No separate issue. Stacked follow-up to #23622; requires the owned Bun relay runtime in that stack.

Visual Proof

N/A — SSH daemon startup and process lifetime; automated receipts verify actual deploy, reconnect and cleanup.

Testing

• Automated unit and native integration tests added.
• Scoped independent Codex and Claude Opus source reviews completed; confirmed findings fixed.
• Real Windows ARM authenticated SSH deploy/reconnect passed at6daf95 in run36501309050, with matching shell state and identity-verified cleanup. This used preview OpenSSH, not the inbox server.
• Focused local tests, TypeScript and lint pass. Final strict native handle isolation, argv, job survival and log rotation tests passed on Windows x64 and ARM64 in run36502866452 (product399647f574, diagnostic2c5953c2cd). This draft still awaits final stack/platform review.
• Windows x64/inbox SSH coverage remains open. No macOS/Linux launcher behavior changes are intended.

Review

The FFI boundary deliberately stays limited to Windows process creation and handle ownership. Native error numbers are diagnostic only. No retry or process-death decision depends on them.

Agent skill upstream boundary

• Not applicable; no upstream skill source copied.

Notes

No runtime pin promotion, merge or release. Diagnostic workflows, measurement files and local plans are excluded from this PR.

Checklist

• Focused on Windows SSH daemon launch.
• Explains user-facing behavior, mechanism and alternatives.
• No UI change requiring screenshots.
• Self-reviewed for correctness, security and process cleanup.
• Considered SSH mixed versions and platform boundaries.
• Final native qualification and CI pass.

[OrcaWin]

Closing as defunct: Orca stays on Node outside Electron, and the bundled-Bun runtime migration this stack belongs to was wound down. Servers and remote hosts now run on the bundled Node 24 runtime (#26171). Launching the Windows relay outside the SSH session job landed separately in #24224.