Harden run-electron port preflight on Windows

[UnlikelyKiller]

This tightens scripts/run-electron.js so local startup behaves more safely on Windows and more predictably across platforms.

What changed

• replace the macOS-only lsof cleanup path with a cross-platform port-8765 preflight
• on Windows, detect listeners via netstat -ano -p tcp and resolve executables via PowerShell/CIM
• only auto-kill the prior listener when it appears to be the same Electron binary
• refuse to start blindly if some other process owns port 8765, and print the PID/executable instead
• keep the non-Windows path working by matching the Electron basename when ps -o comm= returns a shortened command name

Why

On Windows 11, the old script assumed /usr/sbin/lsof and unconditional kill behavior that does not exist or is unsafe there. During local validation, this also helped make conflicts with other listeners on 8765 visible instead of silently starting into a bad state.

Verification

• node -c scripts/run-electron.js
• validated on Windows 11 by launching Tandem successfully after the preflight change
• confirmed the script now refuses to start blindly when another process owns 8765

[hydro13]

Thanks @UnlikelyKiller for this PR and for calling out the unsafe Windows port preflight behavior.

PR #209 addressed the same underlying issue as part of the configurable Agent API port work: startup now checks the configured API port cross-platform, only cleans up prior Tandem/Electron listeners when they are safe to identify, and fails clearly instead of blindly killing unrelated processes.

I did not merge this PR directly because the active startup path moved into scripts/start.js, but your input directly shaped the safety requirement that landed in #209. Much appreciated.