[T-Crypt]

Fixes #103, reported by @azrael-229.

On Windows the PDH Dedicated Usage reading counts a process's committed reservation. The v0.3.2 cap (#82) bounds each process, but the sum could still pass what the driver says the card uses. In the report, dwm.exe read ~11 GB on a 16.3 GB card the driver showed at ~15.5 GB used, so every sized berth run was refused with "at most 0 MiB can be freed".

• The squatter total used for decisions is now min(sum, card used - baseline - what leases and claims really hold). It feeds admission, the contested-grant figure and the "squatters hold N MiB" reason. Lease and claim bytes are their measured per-process readings, not their needs budgets.
• An unknown used figure (0) keeps today's plain sum. On Linux the readings are exact, so the bound does not engage in normal operation.
• Per-squatter entries in status and events keep the raw readings.
• When the clamp engages or lets go, one INFO line (sum_mib, bound_mib), never per tick.

Tests, with the issue's numbers: a 100 MiB probe is granted (red on main: the acquire never returns), a 2000 MiB request still waits with the bounded figure in its reason, a sum under the used figure is unchanged, and the log fires once per state change.

Proof: build, gofmt, vet, go test ./..., -race on the squatter tests, GOOS=windows build and vet, golangci-lint (0 issues).