fix(desktop): reject WSL bash alias during agent discovery

[Cvv9]

What changed

• Reject WindowsApps\bash.exe when resolving Git Bash on Windows. That executable is a WSL app-execution alias, not Git Bash.
• Read existing Claude and Codex credential state directly for their background login-status checks on Windows instead of launching CLI subprocesses.
• Add focused regression tests for the WindowsApps resolver case and both credential formats.

Why

This follows up #2490 and complements #2493. CREATE_NO_WINDOW suppresses ordinary background consoles, but runtime discovery can still select %LOCALAPPDATA%\Microsoft\WindowsApps\bash.exe. Each missing-command lookup then launches WSL and creates wsl.exe, wslhost.exe, and conhost.exe descendants.

On the reporter's Windows 11 installation, opening the Agents screen created three WSL process trees and a separate auth command tree. Rejecting the alias makes the resolver fall through to the actual Git-for-Windows installation. Reading the already-present refreshable credential state removes the remaining Claude/Codex login probe process without changing interactive authentication.

User impact

Opening Agents, selecting agent profiles, and navigating back to Inbox no longer flashes WSL or Command Prompt windows. Discovery is also faster because it avoids starting full CLI processes merely to report whether the user is signed in.

Validation

• cargo fmt --manifest-path desktop/src-tauri/Cargo.toml -- --check
• 5 managed_agents::readiness::cli_probe::tests passed
• 8 managed_agents::git_bash::tests passed
• Production Tauri build completed on Windows 11 with Rust 1.95/MSVC
• Cold-start and click QA verified no visible console windows across Agents, agent profiles, Inbox, and multiple task selections