port(go): async Windows ACL harden for response-state (#645)

[Wibias]

Source

• dev merge: fix(windows): async ACL harden for response-state writes (#612) #645 (341d4863, closes [Bug]: synchronous Windows ACL hardening stalls the proxy on response-state writes #612)
• dev2-go carry: fix(windows): carry async ACL harden onto dig2-go (#645) #686

Gap

TS replaces sync icacls waits on the response-state write path with async ACL hardening (hardenSecretPathAsync / atomicWriteFileAsync), destination-path timeout memo, single-flight persistence, and awaited flush on shutdown (owner-first grant preserved).

Go has go/internal/platform/winacl_common.go and go/internal/server/responses_state*.go — needs parity for async ACL / write-path behavior.

Done when

Go response-state persistence matches the TS oracle with tests green on dev2-go.

[github-actions]

_{Automated translation bookkeeping — detected language: English.}