fix(windows): rollback failed tunnel configuration

[weix37469-web]

Summary

• snapshot the committed Windows Tunnel files and autostart state before applying tunnel configure
• on any later failure, stop the replacement Tunnel, restore the previous state, and attempt to restart the previous Core/Tunnel
• add a Windows regression test that forces a Named Tunnel start failure after a replacement Token has been persisted

Why

agentdock tunnel configure currently persists the replacement Token / URL / mode before the new Tunnel is proven ready. If a later step fails (for example, cloudflared rejects the replacement configuration), the command returns an error but leaves partially committed state on disk.

That means a failed configuration attempt can destroy the last committed configuration instead of behaving transactionally. The installer/update path already has rollback semantics; the direct Windows Tunnel configure path did not.

Tests

• regression test verified to fail on the unpatched main and pass with this change
• go test ./... -count=1 -timeout=3m
• go vet ./...
• go build ./cmd/agentdock
• git diff --check

[weix37469-web]

Closing this PR so I can rework the change from a clean branch and walk through the fix and tests step by step before resubmitting.