test: bound Windows test concurrency and runtime startup

[hetaoBackend]

Change

Windows verification intermittently exhausts the five-second budget in filesystem-heavy Vitest files and the 15-second budget in CLI smoke children that initialize the full runtime. Previous runs failed in different storage suites; a Windows ACP startup took about 22 seconds. Filesystem contention is a working explanation, not a proven sole cause.

• Run declared Vitest gates with one worker on Windows. Individual test deadlines stay unchanged; other platforms keep their existing worker settings.
• Give full-runtime smoke children 30 seconds on Windows, matching the existing ACP budget. Lightweight help/validation and non-Windows startup budgets stay at 15 seconds.
• Improve child error diagnostics and exercise the runner argument contract for Linux, macOS and Windows.
• Document the Windows gate behavior in the testing workflow.

This is the four-file validation change extracted from #170. It contains no config-permission implementation and can be reviewed independently. Serial execution trades throughput and cross-file concurrency coverage for lower filesystem contention; it does not prove concurrent filesystem behavior is correct.

Validation

• PASS: complete pnpm verify full profile, 14/14 gates, on clean committed HEAD e6a26401d2b878523f9d7265dc861e4e72276b1b (macOS arm64, Node 26.4.0).
• The full run includes release-tool runner-contract tests, built CLI smoke tests, capability/BYOK tests, and policy/sandbox gates.
• NOT RUN locally: native Windows/Linux validation, the wider Node compatibility matrix, and live-provider acceptance. Native platform CI for this independent branch must be read separately; earlier fix: restrict credential-bearing config files to owner access #170 CI is not a substitute for this branch's results.

Publication and contribution checks

• Permission to contribute under the existing applicable licenses; existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included.
• No source files were added or removed; no inventory regeneration is needed.
• Verification guidance is updated; offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope and licenses are unchanged. Shared-source port: not needed for these public-distribution verification changes. No merge or release is requested automatically.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}