refactor(windows): reuse packaged verifier for rollback

[testikun]

Summary

Replace the rollback verifier's private assertLaunchable CDP wrapper with the existing verifyPackagedWindowsApp authority, using the explicit legacy-baseline contract for restored pre-upgrade installations.

The rollback-specific filesystem, registry, backup, recovery, fail-closed, and .onInstFailed assertions are unchanged. The duplicate process/renderer/version plumbing is removed, and a focused harness test pins the delegation contract.

Fixes #3575

Verification

• node --test scripts/verify-windows-harness.test.mjs — 40 passed
• npm --workspace @maka/eval run build — passed (required release-test fixture)
• node --test scripts/product-release.test.mjs scripts/verify-windows-harness.test.mjs — 66 passed
• npm run lint — passed
• npx biome check scripts/verify-windows-installer-rollback.mjs scripts/verify-windows-harness.test.mjs — passed
• node --check for both changed scripts and git diff --check — passed
• The real Windows installer rollback gate was not run locally because this workspace is macOS; it remains the authoritative Windows CI check.
• The repository-wide npm run typecheck currently reports unrelated errors in unmodified Runtime Host, CLI, UI, and Desktop files on the latest main.

中文摘要

本 PR 复用已有的 packaged-app verifier 来验证回滚后的旧版本安装，固定使用 legacy-baseline 契约，删除重复的 CDP/进程/版本检查代码；所有备份、注册表、失败恢复和 .onInstFailed 回滚行为保持不变，并补充了 delegation 回归测试。

AI use

• Generative tooling made a substantive contribution

Tool: OpenAI Codex assisted with issue analysis, implementation, tests, and verification.

[Astro-Han]

Looks good, CI is running.

[testikun]

Follow-up fix pushed in 89234bcc4.

The first Windows failure was caused by the rollback path passing the current candidate installation to verifyPackagedWindowsApp with the legacy-baseline contract, which required the retired bundled-git.json. That is now artifactContract: current.

The next Windows run exposed a second integration detail from the verifier reuse: the old rollback-only launcher created the smoke working directory implicitly, while the shared verifier writes packaged-sandbox-manifest.json directly into it. The rollback helper now creates that directory explicitly before delegation.

Local verification: node --test scripts/verify-windows-harness.test.mjs, npm run format:check, and npm run lint pass.

简体中文

回滚验证现在使用 current 契约，并在调用共享 verifier 前显式创建 smoke 目录，修复了 Git 资源误检和 `ENOENT packaged-sandbox-manifest.json` 两个 CI 失败。

Generated-by: OpenAI Codex