[Bug] Windows Desktop 0.5.22 silently ignores start_on_app_launch=true for managed Codex agent

## Summary

On Windows, Buzz Desktop 0.5.22 does not start a local managed Codex agent on application launch even though the identity-backed instance record has `start_on_app_launch: true`.

The failure is silent: no `buzz-acp` process is created, `runtime_pid` remains null, no PID receipt is written, and `last_error` / `last_error_code` remain null. Launching the same agent directly with the same installed `buzz-acp`, Codex ACP adapter, relay URL, private key, and owner attestation succeeds immediately.

## Environment

- Windows 11 Pro, build 26200, AMD64
- Buzz Desktop 0.5.22
- Buzz Relay 0.2.1
- `buzz-acp` bundled with Desktop 0.5.22
- `@agentclientprotocol/codex-acp` 1.1.7
- Codex CLI 0.146.0
- Self-hosted relay reached through a public `wss://` URL
- Local managed-agent backend with `agent_command_override: "codex-acp"`

## Sanitized instance state before launch

```json
{
"name": "Alfred Codex",
"pubkey": "",
"persona_id": "",
"relay_url": "wss://",
"acp_command": "buzz-acp",
"agent_command": "codex-acp",
"agent_command_override": "codex-acp",
"mcp_command": "buzz-dev-mcp",
"parallelism": 10,
"start_on_app_launch": true,
"auto_restart_on_config_change": true,
"runtime_pid": null,
"backend": { "type": "local" },
"provider_policy_pending": false,
"last_error": null,
"last_error_code": null,
"respond_to": "owner-only",
"is_builtin": false,
"is_active": true
}
```

The matching custom persona definition is present in the same store. The agent private key is present in the Desktop credential store. The relay URL is valid and the relay is ready.

## Steps to reproduce

1. Fully stop Buzz Desktop and confirm there is no `buzz-acp` process.
2. Remove stale PID receipts for the affected agent.
3. Confirm the identity-backed instance—not only the persona definition—has `start_on_app_launch: true`.
4. Start Buzz Desktop 0.5.22 normally.
5. Wait at least 15 seconds and inspect the process table, `managed-agents.json`, and `agents/agent-pids/`.

I repeated the clean-state launch after restarting the relay and after removing a stale retained managed-agent definition event. The result was unchanged.

## Actual behavior

- Buzz Desktop starts and remains responsive.
- No `buzz-acp` child process is created.
- The instance's `runtime_pid` remains null.
- No new PID receipt appears.
- `last_started_at` does not advance.
- `last_error` and `last_error_code` remain null.

## Expected behavior

Buzz Desktop should spawn the configured local managed-agent runtime when the identity-backed instance has `start_on_app_launch: true`. If startup cannot proceed, the instance should contain a useful error and the UI should surface it.

## Control test / workaround

Starting the same `buzz-acp` binary directly with the agent's persisted configuration succeeds:

```text
buzz-acp starting: relay=wss:// ... agent_cmd=...codex-acp.cmd ... respond_to=owner-only
connected to relay
subscribed to membership notifications
owner resolved from BUZZ_AUTH_TAG
relay observer enabled
discovered 2 channel(s)
subscribed to channel
subscribed to channel
presence set to online
```

The direct process remains alive, and an authenticated relay query reports the agent presence as `online`. This isolates the failure to the Desktop managed-agent start path rather than the relay, key, owner attestation, ACP adapter, or Codex runtime.

## Related issues

- #2847 documents auto-start configuration/default problems, but its identity-backed records with `start_on_app_launch: true` do start successfully. This report differs because the governing instance flag is already true.
- #4620 documents visible persona versus hidden identity-backed record divergence. In this case the identity-backed record itself is inspected and already has the correct true flag.
- #4678 documents Windows managed-agent configuration problems and silent/stale state.
- #4888 documents a relay-host mismatch in the spawned process. Here no process is spawned at all, and the public relay URL works in the direct-launch control.

## Notes

- Public keys, owner attestations, channel IDs, and private material are intentionally omitted.
- There is only one identity-backed managed-agent instance in the store during this reproduction. The other records are non-running persona definitions.