fix(cua-driver): bound Windows app-name lookup

[f-trycua]

Summary

• bound the uncancellable shell:AppsFolder display-name lookup to four seconds
• keep a timed-out COM worker process-wide single-flight, with a recovery cooldown so retries fail fast instead of accumulating workers
• distinguish lookup-unavailable from a completed lookup miss, and return an explicit not-found error only after Windows PATH/association lookup also fails
• add native Windows unit coverage plus a public-driver MCP regression that proves an unknown launch is bounded and a subsequent list_windows call remains responsive

Fixes #2856.

Validation

• cargo fmt --all -- --check
• cargo test -p cua-driver --test protocol_tools_call_test --no-run --locked (macOS host compile)
• git diff --check origin/main...HEAD
• CI: Rust Windows unit run 30947750775 passed on exact head d2555c7f8547efd7f0c5c10baa176c8f830a9bb8
  • apps_folder_lookup_timeout_is_single_flight_and_recovers_after_cooldown: passed on native Windows in 0.21s
  • launch_unknown_app_is_bounded_and_keeps_mcp_session_responsive: passed through the public MCP driver on native Windows in 1.05s
  • the same job compiled all Windows Rust targets and completed successfully

Review evidence

• issue cua-driver: launch_app with an unknown app name hangs forever instead of returning an error #2856 reports an unknown app-name lookup producing no response before the 120-second client timeout and wedging later calls on the serialized MCP session
• the production lookup deadline returns a structured tool error after four seconds; the uncancellable worker retains the process-wide gate until it actually exits
• a completed AppsFolder miss still falls through to the existing bounded ShellExecuteExW PATH/association route, preserving Win32 name launches
• the native public-driver regression verifies both the unknown-name error and a successful list_windows response on the same MCP session

Notes

Rebased after #2855 merged; its installed-app discovery changes are preserved, and this production change remains confined to the separate launch_app name-resolution path.