Add smoke test for installed source wired to real AppAgentHostApplicator

Nobody has claimed this yet.

## Summary
Add a thin smoke/integration test that wires the installed-agent source lifecycle to the real `AppAgentHostApplicator`.

## Background
The source lifecycle/barrier tests use faithful fake hosts, and the single-lock/no-interleave invariant is pinned in `appAgentHost.spec.ts`. What is missing is a small test that composes the real installed source path with the real dispatcher applicator, so a future regression from coordinated `replaceProvider` back to naive remove+add would fail outside the isolated unit test.

## Suggested Coverage
- install/update/uninstall through `createDefaultInstalledAgentSource`
- a real `AppAgentHostApplicator` using a real command lock
- assertion that replacement runs under the intended single-lock section and does not expose old+new coexistence

## Source
Deferred from PR #2611 review-log cleanup.

Start with createDefaultInstalledAgentSource, AppAgentHostApplicator, and the command-lock setup, then review the existing source lifecycle/barrier tests and appAgentHost.spec.ts. Add a thin smoke/integration test covering install, update, and uninstall through the real components. Done means replacement is verified to use one lock section without exposing both old and new providers.

Written by the indexing model from the issue text.