test(setup): prove Windows replacement cannot follow swapped secret leaf

Extend the Windows atomic setup-write test seam with an after-ReplaceFile observation point and use it to model a malicious target leaf swap to a file symlink.\n\nThe new regression verifies fail-closed behavior at the exact replacement boundary: credential bytes never reach the symlink target, the outside file remains unchanged, the displaced original survives, the concurrent symlink is restored as the rejected current leaf, and the attempted replacement is retained for inspection instead of being deleted.\n\nInclude the current br-3cqr4 P0 tracker checkpoint. Production behavior remains unchanged because the new callback is a no-op outside tests.\n\nVerification note: rustfmt --check reports a layout-only difference in the authored test; exact bytes are preserved under the no-edit instruction, and git diff --check passed.