fix(service): report running after secure control pipe

[bestlux]

Intent

Fix the MSI-owned Windows service-start path so SCM can observe BoundlessService as Running after the secure control named pipe is available, without weakening the allowed-user SID boundary.

Changes

• Split daemon startup into runtime preparation and background task startup.
• In Windows service mode, bind the allowed-user secure named pipe and report SCM Running before starting slower/background runtime tasks.
• Keep service-session input in the unsupported diagnostic mode with no active capture target.
• Add ProgramData startup diagnostics at C:\ProgramData\Boundless\logs\boundless-service-startup.log so failures survive MSI rollback.
• Extend the focused service-mode regression to exercise prepare -> secure named-pipe bind -> background task startup ordering.

Validation

• cargo fmt --all -- --check
• CARGO_INCREMENTAL=0 cargo test -p boundless-daemon service_mode_named_pipe_startup_preserves_diagnostic_input_state -- --nocapture
• CARGO_INCREMENTAL=0 cargo test -p boundless-daemon service_session -- --nocapture
• CARGO_INCREMENTAL=0 cargo clippy --workspace --all-targets -- -D warnings
• CARGO_INCREMENTAL=0 cargo test --workspace --quiet
• CARGO_INCREMENTAL=0 cargo build --release -p boundless-daemon --bin boundless-service
• git diff --check

Elevated validation

This worker shell is not elevated (CODY-PC\iomancer, Administrator=false), so I did not run SCM/MSI install smoke here and did not force UAC. A real elevated service-start smoke is still required before another dogfood package is built.