fix(setup): scope service cleanup to owned processes

[KooshaPari]

Summary

• replace generated global taskkill /IM go.exe and taskkill /IM node.exe cleanup with an owned PID/start-time/command-marker manager
• record and stop only the service process trees created by BytePort setup
• fail closed when ownership metadata is malformed, a PID is reused, or a tracked tree contains a protected Codex/agent process
• keep the Windows setup on the Podman/WSL Containers adapter path

Verification (static only)

• PowerShell outer script parser: pass
• embedded generated service-manager parser: pass
• git diff --check: pass
• bounded token audit: no taskkill, pkill, killall, WSL terminate, or global Docker/container stop tokens
• no setup/service scripts were executed; no processes, runtimes, providers, or sessions were started/stopped/terminated

The generated stop path uses exact tracked handles and explicit protected-process exclusion; uncertain identity refuses to act.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud