feat: add transactional spawn providers

[passcod]

🤖 Adds the alternate-spawn lifecycle shared by blocking and Tokio commands and migrates built-in process setup onto per-attempt policy.

• lets one registered wrapper expose a spawn provider while preserving wrapper registration order
• validates provider availability, immutable command state, and completed attempt state before allocation
• keeps provider cleanup armed through post-spawn hooks and child wrapping, with best-effort rollback on errors and panics
• runs capability-level post-spawn hooks for native, provider, and custom boxed children
• exposes lossless portable argument kinds and environment-inheritance state to providers
• models reusable Unix process-group, session, and signal-mask setup without making portable attempts opaque
• models Windows creation flags, temporary suspension, JobObject assignment, exact resume capabilities, and descendant cleanup
• preserves explicit native transport paths while rejecting attempts to bypass a registered provider
• defines Unix explicit-replacement ordering and ownership, and documents the callback cost of recurring native escapes
• documents provider, hook, child-capability, and transaction ownership contracts

This pull request is stacked on #51. The Unix PTY provider will consume this lifecycle in the next stack layer.

🤖 Generated with Claude Code