feat(installer): add Git, GitIdentity, Port, and WriteAccess preflight checks

Implements IEnvironmentCheck for the four checks derivable without a
Claude CLI probe:
- GitCheck (Error) - resolves git via ExecutableResolver (handles .cmd
  shims), parses `git --version`.
- GitIdentityCheck (Warning) - user.name/user.email presence; Unknown
  (not Failed) if git itself is missing, so it doesn't duplicate GitCheck's
  failure.
- PortCheck (Warning) - loopback bind probe for SignalRPort/ExternalMcpPort;
  resolves the owning process via a new NetstatPortOwnerResolver and treats
  a port held by the running ClaudeDo.Worker (update/repair case) as Ok.
  Both ports are configurable, hence a warning.
- WriteAccessCheck (Error) - create+delete a probe file in InstallDirectory
  and ~/.todo-app (walking up to the first existing parent), not an ACL
  read (ACLs lie on virtualized paths).

Process calls go through a new IProcessRunner wrapping the existing static
ProcessRunner, so checks are fakeable in tests instead of spawning real
processes.

DotnetRuntimeCheck was intentionally not added: per
docs/explore-notes/installer-preflight.md, App/Worker publish
self-contained (no preinstalled runtime needed), and the Installer's own
.NET 8 Desktop Runtime requirement is self-proving - a framework-dependent
apphost can't reach managed code at all if that runtime is missing, so a
check running from inside the process can never observe a failure.

Brings in two prerequisite commits this task builds on that hadn't reached
this branch yet: the IEnvironmentCheck/EnvironmentCheckService scaffolding
and the installer-preflight.md research note.

src/ClaudeDo.Localization/locales/de.json

@@ -628,5 +628,23 @@
       "lastError": "Letzter Fehler: {0}",
       "throttled": "Gedrosselt: {0}/{1} Slots ({2})"
     }
+  },
+  "checks": {
+    "git": {
+      "title": "Git",
+      "hint": "Installiere Git von https://git-scm.com/downloads und starte den Installer neu."
+    },
+    "gitIdentity": {
+      "title": "Git-Identität",
+      "hint": "Führe aus: git config --global user.name \"Dein Name\" und git config --global user.email \"du@example.com\""
+    },
+    "ports": {
+      "title": "Ports",
+      "hint": "Ändere die SignalR-/MCP-Ports auf der Dienste-Seite, oder beende den blockierenden Prozess."
+    },
+    "writeAccess": {
+      "title": "Schreibzugriff",
+      "hint": "Wähle ein anderes Installationsverzeichnis oder starte den Installer mit ausreichenden Rechten (z. B. als Administrator)."
+    }
   }
 }

src/ClaudeDo.Localization/locales/en.json

@@ -628,5 +628,23 @@
       "lastError": "Last error: {0}",
       "throttled": "Throttled: {0}/{1} slots ({2})"
     }
+  },
+  "checks": {
+    "git": {
+      "title": "Git",
+      "hint": "Install Git from https://git-scm.com/downloads, then restart the installer."
+    },
+    "gitIdentity": {
+      "title": "Git identity",
+      "hint": "Run: git config --global user.name \"Your Name\" and git config --global user.email \"you@example.com\""
+    },
+    "ports": {
+      "title": "Ports",
+      "hint": "Change the SignalR/MCP ports on the Service page, or stop the process using them."
+    },
+    "writeAccess": {
+      "title": "Write access",
+      "hint": "Choose a different install directory, or run the installer with sufficient permissions (e.g. as administrator)."
+    }
   }
 }