[procmgr] Config gates for processes.d auto-start - #54732

Parse condition_config_any from processes.d and evaluate config gates
before auto-start; stub always-open gates are replaced in the next commit.

…R 2/4)

Restore core Agent SCM env cache, resolve_executable, tokio baseline env,
secret-backend win32 helpers, and Windows to_command_stdio helpers moved
out of the spawn-profiles PR so each stacked PR carries only what it uses.

Add Agent-parity config gate evaluation (YAML, env, fleet, system-probe
derivations) so processes.d definitions can gate on process_config and related
settings. Secret backend resolution lands in PR 3.

Revert accidental sketches-to-series rename in core_schema.yaml from the
config-gates split. Serializer shadow settings still read sketches.* keys.

Mirror condition_path_exists behavior so ${DD_CONF_DIR} and other
placeholders resolve before YAML gate evaluation.

serde_yaml leaves yes/on as strings while go.yaml.in/yaml/v2 treats them
as true. Apply YAML 1.1 parsing for file lookups only; env stays ParseBool.

Gate integration tests live in #54732 with the real evaluator after they
were removed from the spawn-profiles foundation PR.

Restore pkg/config/setup/BUILD.bazel comments from the base branch.
The #53249 split had added nonexistent schema.codegen flags; this PR
only needs the config_windows_test.go test target wiring.

…g gates

Use sp_bool_default for discovery.enabled so system_probe_config.enabled
derivation matches Go on Linux (true when unset) and ECS Fargate (false).

Resolve fleet policy directory from the config file being evaluated
(system-probe.yaml or datadog.yaml), matching Go system-probe loading.

…g gates

Load YAML with saphyr so YAML 1.1 bool spellings apply only to plain scalars;
quoted strings use ParseBool only, matching agent config semantics.

PATHEXT defaults use uppercase extensions while created files often use
lowercase; match existing files via read_dir when Path::is_file fails.

…ails

Warn and reuse the inherit/NUL stdio path when CreateFileW cannot open a
configured stdout/stderr file, matching Unix and tokio spawn behavior.

Tag queued retries with the originating process UUID and resolve the live
process by incarnation so a timer from a removed process cannot spawn a
replacement with the same name.

Move had_successful_run onto ManagedProcess so set_config can reset
RestartTracker without dropping post-success retry classification, and
add tests for reload plus failed respawn retry chains.

Drop module and API docs that restate obvious behavior; keep short notes
where Win32 spawn/auth semantics are non-obvious.

Treat config-changed reloads like a fresh PM start: reset counters on
set_config, start running/failed auto-start processes under boot gates,
and discard all pending crash timers from before the reload.

Align restart-policy log assertion with the current message format and
resolve rustfmt/clippy failures on the spawn-profiles branch.

Restore process.rs, spawn/mod.rs, and shutdown.rs from the reload-gate
branch so profile/user display and the unified stop path survive the
config-gates rebase onto main.

…ofiles

Keep config-gates on stop().await while adopting the ProcessManager reload
helper split from spawn-profiles, and drop the obsolete align-reload commit.

Replace outdated module comments that referenced hand-written Go
BindEnvAndSetDefault setup with schema YAML env_vars and schema.codegen.

Remove leftover merge markers in may_auto_start and align config-gate
integration tests with RuntimeHandles after the manager module split.