fix(server): keep Windows Prime daemon fallback fail-closed

[rynfar]

Problem

Windows native daemon mode is intentionally disabled because Prime Agent 0.7.2 cannot authenticate named-pipe peers. The manager nevertheless imported the executable-adjacent Prime package before applying that platform guard, so npm shim/package-layout failures could accidentally determine the fallback instead of the security policy.

Solution

Apply the Windows transport-security guard immediately after deriving the private pipe identity, before loading any Prime package code or attempting process startup. The focused regression omits the fake bridge and uses the nonexistent fixture executable, proving the fail-closed outcome does not depend on package discovery and still spawns nothing.

Verification

• vp test run src/provider/prime/PrimeAgentDaemonManager.test.ts src/provider/prime/PrimeAgentBackendSelection.test.ts src/provider/Drivers/PrimeAgentDriver.test.ts — 23 passed
• server typecheck passed with existing Effect suggestions only
• targeted lint — 0 warnings, 0 errors
• git diff --check

Implemented by OpenAI Codex GPT-5.6 Sol using the Prime Agent harness.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for 312c200.

This comment will update automatically after the next completed run.