refactor(desktop): extract the diagnostics preload bridge

### Problem

Part of #4726, scoped to A15 — Preload and bridge.

## Problem

At current `main` (`5a1514c1d`), `apps/desktop/src/preload/preload.ts` is 3,890 lines and owns more than thirty bridge domains.

The diagnostics domain already has a distinct contract in
`apps/desktop/src/preload/diagnostics-contract.ts`, but its implementation is split across the large preload entrypoint:

- diagnostic Host/Session target parsing and resolution;
- execution-target validation;
- renderer locale and user-agent projection;
- report routing;
- previous-main-process-interruption state and IPC methods.

This makes the diagnostics boundary difficult to test independently and keeps domain-specific validation inside the preload composition root.

## Proposed scope

- Add a preload-local diagnostics bridge module that owns:
- diagnostic target parsing and validation;
- manual, renderer-crash, and execution-error wire projections;
- Host/Session target resolution through narrow injected ports;
- the one-shot previous-main-process-interruption read;
- the three existing `MakaBridge['diagnostics']` methods.
- Keep `preload.ts` responsible for Runtime Host identity state and final `MakaBridge` composition.
- Preserve the existing `MakaBridge['diagnostics']` contract, IPC channel names, payload shapes, Host-selection behavior, and renderer-visible errors.
- Add direct tests for default/profile/session/execution targets, invalid or oversized identifiers, unavailable Host resolution, and one-shot interruption reads.

## Measured result

- Remove one complete domain implementation from the 3,890-line preload entrypoint.
- Reduce `preload.ts` by at least 130 lines.
- Give diagnostics projection and validation one independently testable implementation owner.
- Keep runtime behavior and the public bridge surface unchanged.

## Non-goals

- No IPC protocol or channel changes.
- No diagnostic-report content changes.
- No changes to redaction, main-process report generation, or Runtime Host identity authority.
- No extraction of unrelated preload domains.
- No renderer or visual changes.

## Verification

- Focused diagnostics/preload tests.
- Desktop build and typecheck.
- Desktop test suite.
- Repository lint, format, ASF-header, architecture, and diff checks.

I checked the current open pull-request file patches. Several active PRs touch other sections of `preload.ts`, but none changes the diagnostics target-resolution or bridge sections described above.

### Desired outcome

## Measured result

- Remove one complete domain implementation from the 3,890-line preload entrypoint.
- Reduce `preload.ts` by at least 130 lines.
- Give diagnostics projection and validation one independently testable implementation owner.
- Keep runtime behavior and the public bridge surface unchanged.

### Alternatives or workarounds

_No response_