[code-yeongyu]

Part of sisyphuslabs/omo-desktop-app#4199 (senpi PR S7 in the approved #4199 design's plan: the native Windows actual-target process identity adapter and its observation classifier). Stacked on #4302.

Summary

• src/process_handle.rs: RetainedProcess::open(pid) opens a non-inheritable OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION | SYNCHRONIZE) handle; facts() reads GetProcessId, the full 64-bit GetProcessTimes creation FILETIME, the TokenUser SID (OpenProcessToken(TOKEN_QUERY) + GetTokenInformation + ConvertSidToStringSidW) and the exit state, all on that same handle; wait_for_exit(ms) waits on the process object. observe_pid(pid) reopens once (an absent PID is ERROR_INVALID_PARAMETER -> NoSuchProcess).
• src/process_identity.rs: observe(record, observation) applies the design's observation table (4.2a): matching live identity -> Live; signalled object, different readable creation time, verified absent PID -> Gone; access denied, unreadable creation time/SID/exit state, unexpected SID, handle naming another PID, invalid record -> Unknown. Gone never authorizes signalling or adopting the PID's current holder; that is the caller's contract (S10/S13).
• No TypeScript caller, napi export or packaging yet: the reservation (S10) and recovery (S13) PRs consume it.

Tests

• RED: the three new unit tests failed against a stub observe (Unknown(OpenFailed) where the table expects Live / Gone(CreationTimeDiffers) / Unknown(CreationTimeUnreadable)).
• GREEN (macOS): cargo test -p senpi-socket-secret --locked 13 passed: the_observation_table_rows (design table, 8 rows), test_11_deterministic_pid_reuse_is_gone_even_while_the_replacement_lives (design test 11 fakes: replacement created 134000000010000000 at the same PID/SID; one-tick mismatch), every_unreadable_or_inconsistent_answer_is_unknown.
• Windows clippy -D warnings for x86_64- and aarch64-pc-windows-msvc rc=0.
• Native receipts (tests/native_process_receipts.rs, real Windows only, run by the existing socket-secret-native-windows fixture-free step; RECEIPT_IDENTITY lines): a live child matches its record and its exit is observed through the retained handle; a one-tick-older record at the same PID is Gone; a wrapper's identity recorded against the child's PID is not Live; an unused PID is NoSuchProcess. Not run locally (no Windows host, no VM by rule): CI is the receipt.
• Not run: a second-account / standard-user token variant and arm64 hardware execution (the runner is x64; arm64 is clippy-checked only).

Gates

gated-push (each gate its own process, rc=0): cargo fmt check, crate test, clippy Windows x64 + arm64, check-pr-changelog (no-changelog; crate is fork-only, no upstream-owned path changed).