test: isolate credential vaults

[mark-e-deyoung]

Closes #292.

What changed

• adds an explicit DPAPI vault-path constructor that bypasses WinCred probing and the production config directory
• gives each credential test a unique RAII-managed temporary vault
• adds a regression test proving separate vaults cannot observe each other's credentials
• configures CTest to keep temporary vaults under the build tree

Root cause

force_dpapi() selected the file backend but retained the production %APPDATA%\WinInspect\credentials.vault path. Tests therefore depended on external user state and could fail under constrained CTest environments.

Validation

• clean MSVC Release build of all targets
• full CTest: 3/3 passed
• test_core: 10 consecutive CTest runs passed
• post-test artifact check: zero files remain under build/test-tmp
• clang-format dry-run with --Werror
• git diff --check

Formal-method assessment

No TLA+ update is needed: this patch changes dependency injection for storage location and does not alter a modeled protocol or state transition. Existing formal trace replay remains part of test_core and passes.

Follow-up discovered during clean validation

A fresh MSVC configure does not supply /EHsc in this environment; with /WX, C4530 fails the build. Validation used the previously required explicit MSVC flags. That build-system defect will be handled in a separate focused issue/PR.