test: give the Windows descendant probe its own budget

[DeusData]

When a suite leader has already exited, taskkill /T cannot walk its tree, so scripts/run-test-wave.py proves cleanup by asking Windows whether anything is still parented to the dead PID. That PowerShell/CIM probe was timed with --kill-grace, which the parallel gate passes as 1. A cold powershell.exe start routinely costs more than a second on a GitHub Windows runner, so TimeoutExpired — a fact about interpreter start-up, not about the process tree — was mapped to "assume the worst" and failed an already-clean shard with exit 2. Since the probe's latency is unrelated to the state it reports, the proof was probabilistic.

This gives the probe its own stable-state budget (WINDOWS_DESCENDANT_PROBE_SECONDS = 15) plus one retry, and keeps the fail-closed semantics: an exhausted or failed probe still counts as "cannot prove absence". The refusal now names which of the two actually happened — an unfinished probe, or a counted set of live descendants — instead of reporting both as a leaked tree.

Observed on run 33879421262, job 101064442018 (step "parallel suite scheduler contract", CLANG64 x86_64 shard 2/2), on a PR that only touched scripts/hooks/pre-commit; the same leg passed on another PR the same hour. Refs #1741.

Contract pin (deterministic, no sleeps, no timing thresholds). tests/test_parallel_harness_contract.sh now asserts structurally that the probe is bounded by the module constant rather than by the kill-grace argument, that it retries a timed-out probe, that an unusable probe is never read as absence, and that the two failures are reported distinctly. Its Windows leader-exit case waits on the scheduler's refusal instead of on a deadline that is now shorter than the probe budget.

Verification. macOS: the full contract test passes unchanged (all pre-existing cases green), python3 -m py_compile scripts/run-test-wave.py clean, and the new assertions were revert-checked against four mutations (no retry, kill-grace-sized budget, merged failure message, fail-open probe) — each is caught. make -f Makefile.cbm lint-ci is C-only (cppcheck + clang-format over LINT_SRCS/LINT_HDRS), so it does not cover scripts/; no Python linter runs in CI.

Honest limit. The Windows branch cannot execute on macOS — the new probe path itself is exercised here only through the injected-failure assertions. This PR's Windows leg is the confirmation.