fix(release): preserve Windows agent usage and validate Docker (v0.15.23)

[ImPedro29]

On Windows, a temporary file lock could reject the atomic metadata replacement with EPERM: both agents displayed 144 confirmed tokens, but one agent's saved record lost that final usage. Retry only Windows sharing/permission errors with six bounded backoffs totaling 630 ms, keeping the prior complete record and serialized write order. Permanent errors still propagate and clean up the temporary file.

The Docker build also failed because the native terminal-test dependency node-pty requires Python and a C++ compiler in node:22-slim. Install these tools in the build stage and add a full container build plus version/protocol smoke to PR/main checks. The existing required smoke-and-tests check depends on this result.

The terminal fixture now consumes asynchronous HTTP handler failures, accepts a client disconnect while reading a request body and drains handlers before closing. Malformed requests still fail the fixture's network gate. This removes an unhandled ECONNRESET rejection during normal CLI teardown.

Validation adds seven metadata regressions for temporary EPERM/EACCES/EBUSY locks, bounded persistent failures, preservation of the old file, cleanup, recovery and resumed execution ordering. Those plus the existing metadata and workflow contract tests pass locally (10 tests, 66 assertions). Three HTTP fixture regressions also pass under Bun and Node 22/24. All 21 CI checks pass at 8d8726f: 3,068 tests across 337 files (two existing conditional skips), 198 installed CLI cases, 10 real Windows DPAPI checks, 18 HTTP fixture checks, Docker smoke and four native desktop packages.

Version: 0.15.23. Existing release tags remain immutable.