fix(startup): single-instance ordering, shared crash filter, blanker exit (batch 5)

[Maxaubert]

Closes #405.

Fixed

• 14: crash filter now writes the report first and reloads cursors with flag 0 (no SPI broadcast in a faulted process).
• 40: one shared wind::CursorCrashFilter (mag_host.cpp) replaces the duplicates in main.cpp and render_engine.cpp.
• 15: quit event is created inside AcquireSingleInstance as soon as the mutex is owned; a null mutex now refuses to start.
• 93: the global input-state heal runs only after owning the mutex (not on start, not on refusal); the exit-time heal runs before the mutex is released and the atexit net is gated on ownership.
• 101: follows from 93, the restore now runs after any hung incumbent was killed, so a successor never captures tinted pointers as pristine.
• 123: RestoreInputState uses MagApiAcquire/Release instead of raw MagInitialize/MagUninitialize.
• 94: ~CursorBlanker waits at most 2 s for its worker, then detaches (queue state is shared, as in FocusLookup).
• 99: first-run WindConfig launch uses ShellExecuteExW, so it no longer inherits UIAccess.
• 21: hybrid startup falls back to transform-only if the render half fails to init.
• 98: the local-signing script and uiAccess binary are staged in $INSTDIR.stage (admin-only) instead of the user-writable %TEMP% plugins dir; cleaned up after install and uninstall. makensis itself was not run (no release artifacts in the worktree); installer_check shows only the missing-artifact failures that exist on main.

Skipped

• 98 (baked-hash half only): a compile-time hash needs a release.ps1 plumbing change plus an elevated install to verify, so it is deferred. The staging half is fixed (see above).

Tests

• build.bat test: [doctest] test cases: 598 | 598 passed | 0 failed | 0 skipped
• build.bat: exit 0

No version bump: bumped at merge time.

🤖 Generated with Claude Code

https://claude.ai/code/session_011zPmivSAQeivGUdBjTsaMu