fix(startup): make watchdog task keep agent alive

- Use Task Scheduler XML instead of /TR
- Run -ensure agent in-process, not child
- Add console close and panic protection
- Guard nil event channels after stop
- Add non-Windows stubs for startup/mutex

lib/startup/taskxml_test.go

@@ -0,0 +1,48 @@
+package startup
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestWatchdogTaskXMLSeparatesCommandAndArgs(t *testing.T) {
+	t.Parallel()
+	exe := `C:\Users\John Doe\AppData\Roaming\win64_mp\win64_mp.exe`
+	xml := watchdogTaskXML(exe)
+
+	if strings.Contains(xml, `"`+exe+`"`) || strings.Contains(xml, `\"`) {
+		t.Fatalf("task XML must not quote the executable (schtasks /TR quoting broke launch):\n%s", xml)
+	}
+	if !strings.Contains(xml, "<Command>"+exe+"</Command>") {
+		t.Fatalf("Command missing raw path:\n%s", xml)
+	}
+	if !strings.Contains(xml, "<Arguments>-ensure</Arguments>") {
+		t.Fatalf("Arguments missing -ensure:\n%s", xml)
+	}
+	if !strings.Contains(xml, "<WorkingDirectory>C:\\Users\\John Doe\\AppData\\Roaming\\win64_mp</WorkingDirectory>") {
+		t.Fatalf("WorkingDirectory missing:\n%s", xml)
+	}
+	if !strings.Contains(xml, "<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>") {
+		t.Fatalf("execution time limit must be unlimited so -ensure can stay as the agent")
+	}
+}
+
+func TestWatchdogTaskXMLEscapesAmpersand(t *testing.T) {
+	t.Parallel()
+	exe := `C:\Users\A&B\win64_mp.exe`
+	xml := watchdogTaskXML(exe)
+	if !strings.Contains(xml, `C:\Users\A&amp;B\win64_mp.exe`) {
+		t.Fatalf("expected escaped ampersand:\n%s", xml)
+	}
+}
+
+func TestWatchdogTaskXMLStripsCallerQuotes(t *testing.T) {
+	t.Parallel()
+	xml := watchdogTaskXML(`"C:\win64_mp.exe"`)
+	if strings.Contains(xml, `"C:\win64_mp.exe"`) {
+		t.Fatalf("left quotes in XML:\n%s", xml)
+	}
+	if !strings.Contains(xml, "<Command>C:\\win64_mp.exe</Command>") {
+		t.Fatalf("Command not unquoted:\n%s", xml)
+	}
+}