Add fail-closed native worker launcher boundary

[dovvnloading]

Summary

• add a fail-closed NativeWorkerLauncher boundary that accepts only an installer-verified recipe_worker.exe
• revalidate worker bytes immediately before launch planning and construct a fixed broker-only command line
• require a reviewed native process factory and live broker binder before any process is created
• enforce create suspended -> apply Job policy -> bind PID/AppContainer SID -> resume
• add Windows/non-Windows, tamper, identity, cleanup, and ordering tests plus ADR/evidence updates

Validation

• python -m pytest -q — 237 passed, 1 skipped
• python -m ruff check backend/cortex_backend/execution/native_launcher.py backend/cortex_backend/execution/worker_protocol.py tests/test_phase2_native_launcher.py tests/test_phase2_worker_protocol.py
• python -m compileall -q backend/cortex_backend/execution packaging/recipe_worker tests/test_phase2_native_launcher.py tests/test_phase2_worker_protocol.py
• python tools/generate_contracts.py
• git diff --check

Gate status

This PR intentionally does not authorize provider execution. The concrete Win32 process factory, signed installed worker generation, and live broker PID/AppContainer-token binder are still required. No subprocess, shell, stdio, or weaker-sandbox fallback exists; lifecycle/UI remain disabled.