fix(e2e): compare Windows sandbox identity

[abraxas914]

Summary

• compare sandbox roots by canonical path or filesystem identity
• handle Windows 8.3 short-path versus long-path aliases without weakening the sandbox boundary
• reuse the same check in native smoke, bridge startup, and destructive bridge cleanup

Root cause

Nightly correctly launched the bridge from the isolated sandbox, but Node preserved the RUNNER~1 spelling for the harness path while Python reported runneradmin. Exact string comparison rejected the same directory.

Verification

• regression contract uses two hard links with different path spellings
• Vitest: 342/342
• app and E2E TypeScript clean

Follow-up required by Nightly run 29635602999 before desktop-portable-v0.2.1 can be tagged.