#1232 Background tasks keep their own gh shim across an AFT restart

A head reported that a background command lost gh mid-run after AFT restarted: its PATH named the old daemon's pin directory, which a daemon removes when it exits. #1201 gave each background task its own copy of the startup image and shim, but only redirected the task's environment for sandboxed launches through sandbox-launch. Unsandboxed background, promoted foreground and PTY tasks kept pointing at the daemon's folder.

Now every non-launcher spawn plan redirects PATH, AFT_GH_SHIMS_DIR and the shim binary into the task's own startup image (retain_task_environment, reusing #1201's with_task_image and task_environment). Windows, which retained no shim before, hard-links or copies aft.exe into the task and rewrites gh.cmd to point at it. Child PATHs also drop dead daemon pin directories, which had been accumulating across restarts. Only pin-shaped paths are stat-checked, and the order of other entries is unchanged.

Tests:

• A process-level test pins an isolated image, starts background, promoted, PTY and host-escalation tasks, deletes the daemon pin while they wait, then checks gh and the binary still resolve and run from each task's image. It runs in a child test process because the pin is process-global.
• Two PATH tests drop dead pins without reordering, and are idempotent across repeated injection.
• A Windows test checks the retained wrapper outlives the pin.

Verified on the build server, merged with current main: 925 pinned_executable, agent_child_env, bash_background::registry and sandbox_spawn tests, formatting and the Windows check. No release note: the gh shim is CortexKit-only.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes background commands losing gh mid-run after an AFT restart. BACKGROUND: commands' PATHs named the old daemon's pin directory, which the daemon removes when it exits; #1201 only redirected the environment for sandboxed launches through sandbox-launch.

Now every non-launcher spawn plan — unsandboxed background, promoted foreground, and PTY tasks — redirects PATH, AFT_GH_SHIMS_DIR, and the shim binary into the task's own startup image. On Windows, aft.exe is hard-linked or copied into the task and gh.cmd is rewritten to point at it. Child PATHs also drop dead daemon pin directories that had accumulated across restarts; only pin-shaped paths are stat-checked and the order of other entries is unchanged.