fix(app-server): stabilize cross-platform CI regressions

[andrei-hasna]

Summary

• make the schedule test harness preserve notifications and run reliably on Windows
• canonicalize managed-worktree paths and rebind legacy workspace-write permissions on Windows
• persist thread metadata before active-session heartbeats so mailbox ownership remains valid
• add focused regressions for path aliases, permission rebinding, and immediate heartbeat visibility

Verification

• just test-fast-target /tmp/codewith-app-server-cross-platform-target -p codex-app-server message_processor_schedule_tests (27 passed)
• just test-fast-target /tmp/codewith-app-server-cross-platform-target -p codex-app-server --test background_agent (32 passed)
• just test-fast-target /tmp/codewith-app-server-cross-platform-target -p codex-app-server --test all thread_mailbox_dispatcher_does_not_steal_live_target_from_dispatch_disabled_process (1 passed)
• app-server Bazel argument-comment lint targets (7 compatible targets passed)
• staged and origin/main..HEAD gitleaks scans (clean)
• Blacksmith Testbox exact head 5c8ae0df6da8ad96090ca46fe547e574602f9c4f: https://github.com/hasna/codewith/actions/runs/30344383449 (27 + 32 + 1 tests passed)

Scope note

The workspace-wide argument-comment lint currently stops on 11 pre-existing required_consecutive_turns literals in codex-rs/state/src/runtime/goals.rs; this PR does not modify that out-of-scope file. The app-server-only Bazel lint target set is green.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}