fix(desktop): scope agent sweep to the owning app instance

[wesbillman]

Problem

When two Sprout desktop instances run on the same machine — e.g. a just dev build alongside the installed DMG (the standard dogfooding setup) — one instance's cleanup kills the other instance's agents. Symptom: agents stop unexpectedly, all at once, when the dev instance reloads or quits.

Root cause

sweep_system_agent_processes (the machine-wide orphan safety net) matches agent processes purely on binary name + same uid + env SPROUT_MANAGED_AGENT=1. There is no scoping by which desktop instance spawned them, so a dev instance happily SIGTERMs the DMG instance's agents (and vice versa) — they match all three criteria.

The PID-file-based sweep (sweep_orphaned_agent_processes) is already correctly instance-scoped (dev and prod have different bundle identifiers → separate app_data_dir → separate agent-pids/ receipt dirs). This machine-wide scan was the one hole.

Fix

Give each agent an ownership stamp and make the sweep refuse to reap agents that aren't ours:

• Stamp SPROUT_MANAGED_AGENT=<app-identifier> at spawn instead of =1. The app identifier (xyz.block.sprout.app for release, xyz.block.sprout.app.dev for dev) is stable across restarts, so a relaunched instance still recognizes and can reclaim its own prior agents while never matching another instance's.
• process_has_sprout_marker (both macOS KERN_PROCARGS2 and Linux /proc/environ paths) now takes the current instance id and only matches agents carrying that id.
• Added current_instance_id(app) and a shared sprout_marker_entry() helper so the spawn stamp and the sweep matcher can never drift apart.
• Both sweep call sites (lib.rs quit path, restore.rs startup path) pass the instance id.

Ownership becomes a property the agent carries, not a question we poll — so no racy "is another Sprout still alive?" probing.

Verification

• just desktop-tauri-check clean
• just desktop-tauri-clippy clean with -D warnings (--all-targets)
• just desktop-tauri-test — 416 passed / 0 failed, including a new marker_entry_is_namespaced_by_instance_id test pinning the marker format

Notes / out of scope

• The check-file-sizes.mjs override for runtime.rs is bumped 1300→1330 (the file was already at its limit; +40 lines tipped it over). Rationale comment extended.
• Optional liveness-check hardening was intentionally left out — identity stamping makes it redundant.
• There is a separate latent bug where closing the window (vs quitting the app) fires RunEvent::ExitRequested and kills all agents. Real, but not the trigger here and out of scope for this PR — flagging for a possible follow-up.