[coneilen]

Summary

Fixes #758 by marking only committed update backups as cleanup-ready and removing those stale backups from the installed Windows shell once their files are no longer in use. Failed or incomplete rollback directories remain unmarked and are never selected for automatic cleanup.

Changes

• create a durable cleanup sidecar only after the package transaction commits, while preserving successful install status and warning on secondary cleanup failures
• add an installed-shell cleanup worker with strict marker naming, exclusive marker ownership, exclusive file probes, bounded retry, and conservative failure retention
• extend counted rollback contracts, register five cleanup tests in the Windows shell suite, and document the successful-update versus failed-recovery boundary

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\Packaging.Rollback.Tests.ps1 -> committed-cleanup-blocked did not mark the committed backup as cleanup-ready
GREEN: pwsh -NoProfile -File Tools\windows\Tests\Packaging.Rollback.Tests.ps1 -> Package transaction ownership and recoverable rollback contracts (23 cases): PASS
REGRESSION: pwsh -NoProfile -File Tools\windows\validate.ps1 -Task packaging -SwiftExecutable C:\Users\coneilen\AppData\Local\Programs\Swift\Toolchains\6.3.3+Asserts\usr\bin\swift.exe -> Packaging executable install/upgrade/uninstall tests: PASS

Additional validation:

• zig test src\WindowsRollbackCleanup.zig -target x86_64-windows-msvc -lc -lkernel32 with the pinned Winghostty include: 5/5 passed
• pwsh -NoProfile -File Tools\windows\Tests\WindowsShell.Tests.ps1 -ZigExecutable $env:GRAPHCODE_ZIG0152: 58/58 sections, 1405 passed, 17 skipped, 0 failed
• ReleaseSafe Windows product build with pinned Zig and Winghostty: passed
• independent review: clean after fixing marker-lease serialization and a test-only thread-join failure path

No test ran against the user's installed GraphCode. This PR does not implement #780's other-workspaces preflight and does not close the live evidence gaps in #742, #743, or #744.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure