fix(machines): follow-ups from the Windows sign-in startup review (#2087) #2102

Follow-up to #2087 (LOW findings from the merge pass's four review rounds; none blocked the merge).

• Notice flicker: each background retry clears the Windows sign-in notice before the attempt and restores it 10-15 s later; opening the setup dialog in that window does not start it on its own (server/machines.ts reconnect()).
• Poll bound is a count, not a time: the Windows startup poll allows 280 passes, each two PowerShell-over-SSH calls plus 250 ms, so a launcher that never writes a status can hold the automatic update queue for several minutes rather than ~70 s. A Date.now() deadline would bound it.
• No "try desktop start again" in a windows_start_failed dialog: the user has to Cancel and reopen.
• Retry restore applies to every OS: a failed or cancelled dialog setup on a saved, retrying Linux/macOS PC now resumes background retries too. Defensible, but not in the changelog.
• Interactive PowerShell launch has no overall timeout: a hung Task Scheduler call holds the bridge lock, so later starts fail with "Another bridge is starting".
• Scheduler error shown verbatim: raw PowerShell stderr (possibly CLIXML or multiline) reaches the dialog.
• Native tests: the Windows-native tests inject faults with source.replace on exact PowerShell lines without asserting the replace matched, and one accepts waiting_login as a pass without proving the desktop start.
• Leftovers if PowerShell is killed mid-launch: an Ovis-herdr-start-* task and a herdr-start-* directory whose ACL-protected launch.json holds the bridge environment.
• Browser regression writes screenshots into the repo tree (scripts/machine-dialog-regression.ts, evidence/windows-startup).
• Startup status name spelled out three times (windowsBridgeFiles, windowsHost.startupNotice, windowsStartupStatus); startupNotice could use windowsBridgeFiles(session).status.
• Release note: REMOTE_BUNDLE_VERSION stays 37, so this ships to PCs only with the next bundle bump.