fix: repair trust-local lifecycle on Windows

[damonleelcx]

Summary

• make doctor use the shared trust-local install-state source, including USERPROFILE and the .exe suffix on Windows
• resolve other doctor plugin binaries with platform-correct .exe paths
• after schtasks /End, enumerate only the exact installed trust-local.exe processes
• terminate each matching root with taskkill /T /F, retry races, and refuse to report success while survivors remain
• make Windows restart use the verified stop path before starting again

Root causes

QA20: doctor checked HOME/.aikey/bin/trust-local without .exe, classified an installed Windows daemon as absent, skipped auto-start, and still allowed the advisory doctor summary to pass.

QA21: Task Scheduler ended the hidden launcher but left the PyInstaller parent/worker process tree alive. The CLI trusted scheduler success without verifying process state.

Validation

• cargo test --lib: 1142 passed, 5 ignored, 0 failed
• cargo test trust_local_service --lib
• cargo test doctor_plugin_paths_add_exe_on_windows --lib
• cargo test commands_service::commands::tests --bin aikey
• Windows cross-check: cargo check --target x86_64-pc-windows-gnu
• cargo fmt -- --check
• git diff --check

Coordinated installer PR

• aikeylabs/workflow#35

[damonleelcx]

Aliyun Windows 10 regression: QA20 PASS (doctor detected trust-local unreachable, attempted start, restored :8801); QA21 PASS (service stop trust-local --json exited 0 and left no trust-local process or :8801 listener, then doctor restored it). Explicit Claude Sonnet routing also passed. The failing aggregate CI job is workspace/environment-related; the new trust-local unit tests themselves passed in the job log.