fix: enforce durable Windows launch release barrier

internal/client/agent/executor.go

@@ -118,12 +118,10 @@ func (executor *Executor) launch(ctx context.Context, issue domain.UUID, revisio
 		return err
 	}
 	// The native Windows supervisor creates/assigns the Job while the child is
-	// suspended and releases it before returning. Marking authorization before
-	// that call makes a daemon crash in any of those windows recover as an
-	// interrupted, non-redispatchable command.
-	if err := executor.Store.SetLaunchPhase(ctx, issue, domain.LaunchPhaseAuthorized, "pending", 0); err != nil {
-		return err
-	}
+	// suspended. It does not cross the durable authorization barrier until the
+	// process object has been fully prepared and its immutable identity is
+	// available. A daemon crash before this write leaves only launch_prepared;
+	// the kill-on-close Job prevents a suspended child from surviving restart.
 	runContext, cancel := context.WithCancel(context.Background())
 	process, err := executor.Supervisor.Start(runContext, supervisor.StartSpec{IssueUUID: issue, CommandRevision: revision, Execution: proto.Clone(spec).(*rvboxv1.ExecutionSpec), ScriptBody: scriptBody, WorkingDirectory: workingDirectory, Environment: cloneEnvironment(spec.GetEnvOverrides()), ExecutionProfiles: executionProfileNames(spec.GetExecutionProfiles())})
 	if err != nil {
@@ -141,6 +139,11 @@ func (executor *Executor) launch(ctx context.Context, issue domain.UUID, revisio
 		cancel()
 		return err
 	}
+	if err := process.Release(runContext); err != nil {
+		_, _ = executor.Supervisor.Signal(context.Background(), process, supervisor.SignalKill)
+		cancel()
+		return err
+	}
 	executor.mu.Lock()
 	executor.active[issue] = process
 	executor.cancel[issue] = cancel