[RT-E6] test: characterize the background-service contender

[Blind-Striker]

What

Characterization tests for the background-service contender ahead of RT-E6. RT-E6 step 4 moves the contender onto StderrTail and ChildExitWatch; step 2 moves it onto ChildCommand and HostEnvironment. These tests pin today's observable behaviour, so RT-E6 can show "no behaviour change". Test-only. This is the contender half; the launcher half is #407.

Pinned

• ServiceContenderTests, extending the file [RT-SW-399] fix: contender stderr redacts a handoff ticket the tail cut or the pipe end splits #404 created for the redaction fix:
  • no redaction when the ticket is null or empty;
  • a stderr read fault reports exactly "The background service contender (pid N) failed to start.", with the same inner exception, and stops being reported after disposal;
  • on POSIX, a pid that is not this process's child reads as an unknown exit. It is finished at the end of stderr, not "exited zero", and not a failure. The Windows arm reports honestly that no faithful fake handle exists;
  • Release drops the retained tail.
• ServiceContenderSpawnerRequestTests (new, beside ServiceContenderSpawnerTests so it avoids TST-E1's edits there):
  • the overlay NUL refusal (message built as new ArgumentException(text, ParamName).Message; ParamName not pinned);
  • the batch shim: refused off Windows with the exact text, routed through cmd.exe without detaching on Windows;
  • the spawn-failure text with the resolution inside the quotes, and without one;
  • the request's Null/Null/Pipe streams and detaching;
  • an overlay that removes and sets variables;
  • the handoff variable passed when non-empty and removed when empty;
  • a missing stderr read end, refused, with the Windows handle closed.

Not pinned, on purpose

The intended RT-E6 fixes: U4-01 (Windows 259), U4-12 (the handle after Release), U4-13 (a reused pid), U4-09 (EPERM), U4-26/27 (beyond the observable request), and the U3-16 spelling.

Proof

• Mutation: 13 compiling product mutants in ServiceContender.cs, ServiceContenderSpawner.cs and ServiceContenderSpawner.Windows.cs. Each turns exactly its own row red among the 22 cases on net10.0. Two analyzer-rejected attempts were discarded and rewritten. POSIX-only rows (the unknown exit, the batch refusal, the POSIX request arms) run on CI's Linux and macOS legs.
• Runs: both classes pass on net10.0 and net472 (22/22 each), rebased onto master 78d47a16.
• Checks: the full build is 0/0 on every TFM; both format passes; verify-clones 0 new; the repository guards 93/93; slopwatch clean.
• Local check: the stacked check with [RT-E6] test: characterize the launcher's spawn request and Windows strategy #407 at 70eef249 failed on one guard: the collapsed-assertion guard (Rule A) found two Assert.That(dict.ContainsKey(...)).IsFalse() sites in this file. Both are now DoesNotContainKey, and the site list did not grow. Every other step passed: slopwatch, build, format, clone-detector, verify-clones, election, and the rest of the 10,146 tests. The two-line fix was rerun narrowly (classes, guards, verify-clones), with CI as the full gate (lead, 2026-10-17).
• Reviews: the Runtime coordinator, plus a fresh read-only Sol review (no findings).

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}