Spike: net48-only launcher (evaluate size vs net8 self-contained)

Converts the Launcher Service + Agent from net8/win-x64 self-contained to net48
framework-dependent, and makes Tesla.Contract net48-only (drops multi-targeting).
Both consumers (Console + Launcher) are now a single TFM.

Code changes for net48 (the only net8/netstandard2.1 APIs in use):
- RandomNumberGenerator.Fill -> RandomNumberGenerator.Create().GetBytes (3x)
- TcpListener.AcceptTcpClientAsync(ct) -> AcceptTcpClientAsync() + stop-on-cancel
- byte[].AsSpan().SequenceEqual -> Linq SequenceEqual (no System.Memory) (2x)
- PipeStream.Write(byte[]) / WriteAsync(byte[],ct) -> explicit (buf,0,len[,ct])
- Math.Clamp -> Math.Max/Min
The generic host (Microsoft.Extensions.Hosting 8.x + UseWindowsService) runs on
net48 unchanged. build.bat/install.bat updated for the folder-of-DLLs deploy;
solution platform reverted x64 -> AnyCPU.

RESULT — package size: ~3.7 MB on disk / 1.58 MB zipped, vs ~213 MB / 91 MB for
the net8 self-contained build (~50-58x smaller). net48 ships in Win10/11 so no
runtime prerequisite. 73 tests green; NOT re-validated on a live pod.

Spike branch for evaluation — do not merge without a pod re-test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Launcher/SecureConfig.cs

@@ -21,6 +21,7 @@ using System.Net.Sockets;
 using System.Net.NetworkInformation;
 using System.Text;
 using System.Security.Cryptography;
+using System.Linq;
 using System.Threading;
 using System.Diagnostics;
 using Microsoft.Win32;
@@ -813,7 +814,7 @@ namespace TeslaSecureConfig
                     TcpReadExact(netStream, consoleIv);
 
                     var podIv = new byte[16];
-                    RandomNumberGenerator.Fill(podIv);
+                    using (var rng = RandomNumberGenerator.Create()) rng.GetBytes(podIv);
                     netStream.Write(podIv, 0, 16);
                     netStream.Flush();
 
@@ -836,7 +837,7 @@ namespace TeslaSecureConfig
 
                     var confReply = new byte[4];
                     TcpReadExact(ofb, confReply);
-                    if (!confReply.AsSpan().SequenceEqual(confMsg))
+                    if (!confReply.SequenceEqual(confMsg))
                     {
                         Log($"CONF mismatch: got [{BitConverter.ToString(confReply)}], expected CONF — key/IV mismatch.");
                         return;
@@ -1188,7 +1189,7 @@ namespace TeslaSecureConfig
         private static string GenerateRandomString(int length)
         {
             var buf = new byte[length];
-            RandomNumberGenerator.Fill(buf);
+            using (var rng = RandomNumberGenerator.Create()) rng.GetBytes(buf);
             var sb = new System.Text.StringBuilder(length);
             for (int i = 0; i < length; i++)
                 sb.Append(Proto.Alphabet[buf[i] % Proto.Alphabet.Length]);