fix(android): clean Windows workspaces after owner termination (#2440)

* fix(android): clean Windows workspaces after owner termination

* fix(android): retain Windows workspace guardian on cleanup failure

* fix(android): preserve released guardian pipe state on cleanup retry

* fix(android): normalize extended local guardian parent paths

---------

Co-authored-by: LcokHcak <268763621+LcokHcak@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

native/windows/README.md

@@ -90,8 +90,10 @@ without this lane reports Windows native controls as unavailable.
   root and ancestor leases for retry; a partially removed runtime accepts only
   cleanup, and its registry entry remains until removal succeeds. Normal close, cancellation,
   startup failure, and timeout release provider resources. Abrupt owner death
-  kills the owned job; it can leave private runtime files for later operator
-  cleanup and does not claim transactional deletion after a crash.
+  kills the owned job. The Android provider additionally uses a detached helper
+  that owns its private runtime directory and cleans it when the owner pipe
+  closes. Other providers can leave private runtime files after owner death;
+  helper death and host power loss are not transactional deletion.
 
 Windows failures retain their constraint, requested coordinate, Win32 code,
 and system message. Unsupported filesystems and reparse paths are distinct
@@ -115,8 +117,10 @@ the supported device/UNC namespaces; existing admission checks still apply.
 
 The bearer-token descriptor remains under its immutable private lease until
 `runtime_close` on Windows; POSIX removes the descriptor after the bridge reads
-it. Job ownership guarantees process termination on owner death, not deletion
-of private files after a crash. SUBST drive aliases and changing DOS-device
+it. Job ownership guarantees process termination on owner death. Android's
+detached workspace helper provides a separate cleanup owner for that provider,
+but simultaneous helper death or power loss can still leave private files.
+SUBST drive aliases and changing DOS-device
 namespaces are outside the verified P0 scope and are not detected as a separate
 alias policy. Mounted-folder paths that report a reparse tag are rejected by
 component admission; broader namespace variants remain unverified. Preserve