fix(sdk): reach the AppContainer + DACL tier from the streaming path (#645)

The mxc-sdk streaming path (`spawn_sandbox` -> `mxc_engine::dispatch`)
resolved Windows ProcessContainer to only two tiers -- BaseContainer when
usable, otherwise AppContainer + BFS -- so a host with neither the
BaseContainer API nor `bfscfg.exe` failed closed instead of falling back
to AppContainer + DACL (Tier 3). The run-to-completion executor path
already had all three tiers via `dispatch_with_fallback`.

Extract the tier -> (backend, DACL) mapping into a shared
`select_backend_with_fallback`, and add a streaming `spawn_with_fallback`
that both surfaces go through, so they can no longer drift. The returned
handle owns any `DaclManager` via `DaclGuardedProcess`, whose field order
restores host ACEs only after the child tree is torn down, matching the
run-to-completion drop order.

On a spawn failure after tier selection, carry the selected tier and the
tier-selection warnings in `SpawnDispatchError::Spawn` so the engine logs
them just like the run-to-completion resolve path (which logs before its
separate spawn), keeping diagnostics parity.

Resolves #643


Copilot-Session: 3005336c-50df-445b-a777-7f140edf929c

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: caarlos0