dsh-restart v0.2.1

dsh-restart 0.2.1

Two silent failures made the restart button look like it "only closed DSH".
Both are fixed, and the failure mode is now structurally impossible rather than
merely unlikely.

Fixed

A headless orphan was mistaken for a running instance.
Packaged CLI runs leave a dsh-desktop-host process behind after the app exits.
With its parent gone it looks like a process-tree root, so the helper believed an
instance was already running, skipped the relaunch, and the killed app never came
back. Liveness is now decided by the app's window — an enumerated top-level
window that is visible, unowned and classed Chrome_WidgetWin_1 — which a
headless host can never match. A failed probe only logs and relaunches; it is
never read as "already running".

The helper was launched through WMI and never actually ran.
Win32_Process.Create returned success and a pid on some machines while the
created process executed none of its payload. The helper never started, the app
was closed, and nothing brought it back. The helper is now started through the
.NET process APIs, with a detached-spawn fallback.

Hardened

• The launcher is no longer trusted on its pid alone. The helper writes a
  readiness marker as its first statement and the host waits for it before
  touching the application. If the helper never reports, the restart is abandoned
  with a log line and the app is left running.
• Guards against a reused target pid before terminating anything.
• The button glyph is redrawn as a heavy ring with a solid head, so it stays
  legible down to 16px (the old hairline ring with a chevron head read as a
  broken letter G).

Verification

• 33 consistency gates, including byte-for-byte src↔lib equality.
• 31 unit and integration tests.
• A self-delete e2e run and an offline launcher-handshake check that fails a
  launcher which reports a pid without actually starting.

Upgrade note

The host half is bundled and does not hot-reload: restart DSH after
upgrading for the fixes to take effect.