fix(uninstall): refuse to operate on system process names

force_kill_app takes its kill target from CFBundleExecutable, a string a
third-party .app can set to anything. The selection layer
(uninstall_app_is_currently_eligible in bin/uninstall.sh) already filters
out protected bundle IDs, but force_kill_app is a public function and
any future caller would bypass that gate.

Add a defensive case for the common system process names (Finder, Dock,
loginwindow, WindowServer, SystemUIServer, launchd, coreaudiod,
NotificationCenter, ControlCenter, Spotlight) so the boundary travels
with the function itself instead of depending on caller discipline.

The new test exercises the guard against five spoofed names and
verifies neither pkill, pgrep, nor osascript runs.