Fix Windows supervisor replacement launch lock

[jonaowen]

Summary

• place the replacement-supervisor launch lock in the existing real filesystem supervisor registry instead of the daemon endpoint directory
• handle Windows directory-rename collision semantics without treating a live contender as a launch failure
• add a cross-platform regression using a literal Windows named-pipe endpoint and the real replacement method

Validation

• focused regression: 1 passed
• npm run check: green (Biome, tsgo, installer render, browser smoke)
• fresh adversarial review: GO after one correction moved registry creation under the existing reset guard

The patch does not change daemon wire/schema/protocol behavior. It preserves the existing socket hash and stale-lock algorithm; PID-reuse/token/ABA hardening is separate scope.

Fixes #1286.

Note

Fix Windows supervisor replacement launch lock in AgentDaemon

• Changes the lock directory base in launchReplacementSupervisor from dirname(supervisorSocketPath) to a global registry directory from defaultDaemonSupervisorRegistryDir(), fixing failures when supervisorSocketPath is a Windows named-pipe path with no valid filesystem directory.
• Creates the registry directory with mode 0o700 before use and treats EPERM on rename (when the destination already exists) as equivalent to a pre-existing lock rather than throwing.
• Exports defaultDaemonSupervisorRegistryDir from daemon-supervisor-ownership.ts so it can be imported by the daemon mode module.
• Adds a regression test in 1286-windows-supervisor-lock.test.ts covering the named-pipe path scenario.

^{Macroscope summarized a62ed57.}

[jonaowen]

Rebased cleanly onto current main 5e268e28f. Post-rebase focused #1286 regression: 1/1 passed. Post-rebase npm run check: green; 910 files checked, no fixes, tsgo/installer/browser smoke passed.

[jonaowen]

Rebased onto current main 7787f0741. Post-rebase focused #1286 regression: 1/1 passed. npm run check: green; 910 files checked, no fixes, tsgo/installer/browser smoke passed.