Harden Windows lifecycle and persist audit records

[jmcte]

Summary

• make Windows runner configuration, execution, removal, and generated Docker Compose commands check native exit codes explicitly
• prevent failed config.cmd calls from marking a runner configured and redact tokens from bounded operator-facing failures
• persist lifecycle audit records beneath durable runner state paths for Synology, Linux Docker, Windows, and Lume
• collect Lume guest audit records on the host, serialize audit rotation across processes, and report missing, unwritable, stale, or healthy logs truthfully

Governing Issues

Closes #154
Closes #156

Validation

• pnpm lint
• pnpm test (48 files, 274 tests)
• bash -n scripts/lume/lib.sh scripts/lume/run-slot.sh scripts/guest/macos-runner-bootstrap.sh
• Compose and install snapshots updated for persistent audit paths
• git diff --check

Bootstrap Governance

• Changes are scoped to the linked issues
• No contributor or PR guidance changes
• Auto-merge enabled
• No secrets, runtime auth, or machine-local files committed

Merge Automation

• Squash auto-merge enabled

[athena-omt]

I refreshed the PR branch before review because GitHub reported the previous head as behind main. The PR is now at dcb1ed7d94e7f708a03bc8cdf6dfcbdb11af0afd, auto-merge is enabled with squash, and most checks have completed successfully. I’m deferring the substantive review because CI is still running on the refreshed head: codeql remains IN_PROGRESS.

[athena-omt]

Athena approval after refreshing and reviewing the current head.\n\nEvidence checked:\n- Route/auth: ran from Athena node OMT-NAS as root with git identity Athena Athena-omt@protonmail.com and gh account athena-omt.\n- Initial required head/base: live PR initially showed head e7bb882 over base 2b2b93c, but current main had advanced to 09bf927 and GitHub reported mergeStateStatus=BEHIND. Per review freshness policy I updated the branch before substantive review.\n- Reviewed current head fb4690c against base 09bf927; merge-base check confirms base is ancestor of the reviewed head.\n- CI on fb4690c is complete with required successes: CI/test, linux docker contract, lume macos contract, PR Fast CI gate, Security/codeql, dependency-review, and osv; expected platform/fork-only jobs are skipped. Auto-merge remains enabled with squash.\n- Local verification on the Athena node: pnpm run lint; pnpm test; plus targeted vitest for audit, entrypoint, Lume scripts, Windows install/compose, and doctor all passed.\n\nI reviewed the Daedalus conflict areas and the lifecycle/audit changes: Windows native command exit handling redacts tokens before surfacing command failures, audit paths are state-directory scoped for Linux/Windows/Lume planes, Lume guest audit collection preserves JSONL records with host-side rotation, and doctor now reports missing/unwritable/stale audit logs as warn/fail instead of treating the path as always healthy. No approval-blocking issues found.