windows: add kill-on-close job process primitives

[anp-oai]

Intent

Windows unified-exec launchers need a compatibility-safe primitive that guarantees a child cannot run user code before it belongs to a configured kill-on-close Job Object. This deliberately avoids the Windows 10-only PROC_THREAD_ATTRIBUTE_JOB_LIST path.

Implementation

• Add shared KillOnCloseJob, SuspendedProcess, and JobProcess types in codex-utils-pty.
• Share one non-inheritable kernel job handle across controller clones without duplicating it.
• Terminate and wait for an uncommitted suspended child on every setup failure.
• Require successful job assignment and an exact initial suspend count before returning a running process.
• Add a private Win32 API seam with deterministic creation, configuration, assignment, and resume failure coverage.

Manual validation

• Cross-compiled the codex-utils-pty Windows test target with cargo +1.95.0 check --target x86_64-pc-windows-msvc -p codex-utils-pty --tests.

Stack

1. job primitives → 2. local ConPTY → 3. restricted sessions → 4. elevated runner → 5. command preparation → 6. raw pipe launcher → 7. command parity