[gcl-coder]

Summary

interaction_contract builds the heartbeat-receipt retry action a host runs when
a heartbeat_receipt is missing or write_failed. It appended a literal
--turn-instance-id "${LOOPX_TURN:?}".

#7823 made the settlement-plan owner render the Turn reference for the shell
that actually runs it. The retry hint is a separate owner and kept the
POSIX-only literal, so a native Windows host still receives an empty Turn there
and the retry cannot repair the receipt it was asked to repair.

Change

• turn_instance_arg() in loopx/control_plane/quota/effect_program.py owns the
  rendering: $LOOPX_TURN on native Windows, "${LOOPX_TURN:?}" on POSIX, and a
  concrete Turn passed through unchanged.
• settlement_binding_args() now builds its Turn argument through the same
  helper, so the rule has one owner instead of a second copy. Its POSIX output
  stays byte-identical to the previous implementation.
• The heartbeat-receipt retry hint uses the helper instead of its own literal.

Tests

• tests/control_plane/test_turn_instance_arg.py (new, 6 cases): the host
  default on both shells, a concrete Turn on both shells, a POSIX reference seen
  on Windows, and the reference the real running host produces.
• The heartbeat retry action test is now parametrized over both hosts and
  asserts the complete action string on each.
• The new file is added to the windows-powershell lane, so the native
  os.name == "nt" default is qualified on a real Windows runner rather than
  only through a patched host flag.

Notes

• A missing variable still fails closed: an unset $LOOPX_TURN reaches the CLI
  empty and is rejected by the existing Turn validation, exactly as an unset
  LOOPX_TURN does on POSIX.
• Scope: one helper, one call site, plus tests. The scheduler fallback hint in
  loopx/control_plane/scheduler/hint_followup.ts still falls back to the POSIX
  literal; it needs host information the current request does not carry, so it
  is deliberately left out of this change.