Fix Windows daemon lifecycle JSON output and qualify task ACL recovery

[callumalpass]

Summary

• Capture Task Scheduler output instead of leaking SUCCESS messages into the CLI JSON stream; retain command diagnostics on failure and leave log streaming unchanged.
• Add native Windows qualification using the actual current CLI and Node execFile/whole-stdout JSON.parse for install, replacement, start, stop, restart, status and uninstall.
• Reproduce an administrator-owned task denying a separate standard-user principal; verify owner-assisted task-only removal permits normal registration. Do not bypass ACLs or automatically elevate.

Evidence

• Red native CI: https://github.com/mdbase-dev/mdbase-connect/actions/runs/35154899524 — exact reported Unexpected token S failure; all pre-existing probe scenarios passed.
• ACL reproduction: https://github.com/mdbase-dev/mdbase-connect/actions/runs/35155071123 — standard-user replacement denied for an administrator-created task.
• Local CLI tests: 23 unit + 12 integration passed. Formatting, architecture and workspace pin checks passed.
• Green native CI: https://github.com/mdbase-dev/mdbase-connect/actions/runs/35155214056 — all five jobs passed, including the same actual-CLI reproduction now passing all lifecycle commands with parseable stdout.
• Owner-assisted repair fixture passed in https://github.com/mdbase-dev/mdbase-connect/actions/runs/35155473368: denial before owner removal; standard-user install/replacement/uninstall afterward. No Connect state deletion.
• Exact-head full PR qualification PASSED: https://github.com/mdbase-dev/mdbase-connect/actions/runs/35155592826 — all five Windows lifecycle jobs, Node, Rust workspace, all six system-suite shards, runtime interoperability, upgrade/rollback, Windows/macOS filesystem durability, and aggregate Qualification passed.
• Desktop regression/package smoke checks passed: https://github.com/mdbase-dev/mdbase-connect/actions/runs/35155591547.

Limits

This addresses part of #428, not the entire issue. It does not establish the reporters’ task ownership, same-account UAC transitions, packaged Electron/Squirrel/logon behavior, or a hidden scheduled daemon console. Rejected credentials, missing mirror files and application validation loops remain separate investigations. No release, account reset, grant deletion or automatic task-permission changes.

Related to #428.