v0.7.2

Hardening on the collect-path spill, prompted by deepseek-harness#2252.

That report is about the stock collector. A Windows temp cleaner (火绒, CCleaner, Storage Sense) removes %TEMP%\dsh-subprocess-* during a long session, the next spill open throws ENOENT out of a stream data listener, and the whole host process dies. Still reproducible at rc.6.

dsh-win32 rewrites collect-mode stdio to raw pipes on win32 in order to sniff and decode legacy code pages, and its collector already caught spill failures, so that crash class does not reach the collect path here. Two things changed anyway.

• The catch dropped the spill descriptor without closing it, leaking one fd per failure.
• The spill directory is re-made on every open rather than cached for the process lifetime. That is what makes a temp cleaner harmless, it was incidental before, and it is covered by tests now (one for the cleaner case, one for a spill target that cannot be created at all).

43 unit tests, 3-OS CI matrix. No behavior change for anyone who was not hitting a spill failure.