Strengthen spawn ownership model

[P4suta]

Summary

• replace stored pseudoconsole dynamic dispatch with an HPCON snapshot plus lifetime marker
• model running and suspended spawn plans/transactions with private typestates
• unify handle-transfer ownership and standard-handle state, including the documented ConPTY startup shape
• strengthen suspended resume and output-reader cleanup contracts
• replace xtask's boxed dynamic errors with a concrete TaskError enum
• update ADRs, crate documentation, changelog, and regression tests

Why

The previous implementation encoded several ownership invariants with parallel vectors, booleans, sentinels, and duplicated raw-pointer state. This change moves those invariants into Rust values and typestates while preserving the public API and Rust 1.75 support.

User impact

Public signatures remain unchanged. Observable behavior changes are limited to:

• SuspendedChild::resume rejects externally changed suspend counts and rolls the process back.
• wait_with_output joins both reader threads even when one reader fails or panics.
• ConPTY startup no longer sets STARTF_USESTDHANDLES and leaves ordinary standard handles zeroed.

Validation

• cargo xtask fmt
• cargo xtask clippy
• cargo xtask test
• cargo xtask msrv
• cargo xtask cross-targets
• cargo xtask linux-empty
• cargo xtask public-api
• cargo xtask coverage (94.82% regions, 98.05% functions, 97.22% lines)
• cargo xtask package-check --allow-dirty
• cargo xtask release-candidate --allow-dirty
• mutation suite: 333 mutants audited; the 3 initial survivors were covered by added tests, and the targeted rerun caught all 5 matching mutants with no missed or timeouts