Preserve root-cause startup diagnostics when the buffer fills

[leehack]

Problem

LlamaCppService._recordStartupDiagnostic keeps at most 32 entries with a simple FIFO eviction policy. On noisy startup paths—especially Windows backend teardown and FreeLibrary diagnostics—later cleanup noise can evict the earlier library-discovery entry that explains the root cause.

This was identified while fixing #386 / PR #392. It does not block the acknowledged worker initialization handshake, but once #386 closes it needs a durable tracker of its own.

Current behavior

• _maxStartupDiagnostics bounds the list at 32 entries.
• _recordStartupDiagnostic removes index 0 whenever the list is full.
• formatStartupDiagnostics preserves the newest rendered tail.
• Therefore entry-count eviction and rendered-length truncation both favor the latest messages, even when those messages are teardown noise rather than the causal discovery failure.

Desired behavior

Retain a bounded, sanitized diagnostic summary that preserves root-cause discovery failures while still reporting meaningful final outcomes. The design should distinguish at least causal discovery/probe failures from teardown/noise instead of merely reversing FIFO order.

Acceptance criteria

• Add a priority/category-aware bounded retention policy, or another evidence-backed policy that preserves causal entries under noisy teardown.
• Keep output length bounded and preserve the existing credential/control-character sanitization contract.
• Add a deterministic overflow regression modeled on Windows discovery plus teardown ordering.
• Do not expose bearer tokens, signed URL components, credentials, or control characters.
• Document any ordering/deduplication semantics that callers may rely on.

Related: #354 tracks broader native-library resolver cleanup, but not this diagnostic-retention behavior.