feat(installer): add Git, GitIdentity, Port, and WriteAccess preflight checks

Implements IEnvironmentCheck for the four checks derivable without a
Claude CLI probe:
- GitCheck (Error) - resolves git via ExecutableResolver (handles .cmd
  shims), parses `git --version`.
- GitIdentityCheck (Warning) - user.name/user.email presence; Unknown
  (not Failed) if git itself is missing, so it doesn't duplicate GitCheck's
  failure.
- PortCheck (Warning) - loopback bind probe for SignalRPort/ExternalMcpPort;
  resolves the owning process via a new NetstatPortOwnerResolver and treats
  a port held by the running ClaudeDo.Worker (update/repair case) as Ok.
  Both ports are configurable, hence a warning.
- WriteAccessCheck (Error) - create+delete a probe file in InstallDirectory
  and ~/.todo-app (walking up to the first existing parent), not an ACL
  read (ACLs lie on virtualized paths).

Process calls go through a new IProcessRunner wrapping the existing static
ProcessRunner, so checks are fakeable in tests instead of spawning real
processes.

DotnetRuntimeCheck was intentionally not added: per
docs/explore-notes/installer-preflight.md, App/Worker publish
self-contained (no preinstalled runtime needed), and the Installer's own
.NET 8 Desktop Runtime requirement is self-proving - a framework-dependent
apphost can't reach managed code at all if that runtime is missing, so a
check running from inside the process can never observe a failure.

Brings in two prerequisite commits this task builds on that hadn't reached
this branch yet: the IEnvironmentCheck/EnvironmentCheckService scaffolding
and the installer-preflight.md research note.

tests/ClaudeDo.Installer.Tests/Checks/FakeProcessRunner.cs

@@ -0,0 +1,22 @@
+using ClaudeDo.Installer.Core.Interfaces;
+
+namespace ClaudeDo.Installer.Tests.Checks;
+
+internal sealed class FakeProcessRunner : IProcessRunner
+{
+    private readonly Queue<(int ExitCode, string Output)> _responses;
+
+    public FakeProcessRunner(params (int ExitCode, string Output)[] responses)
+    {
+        _responses = new Queue<(int, string)>(responses);
+    }
+
+    public List<(string FileName, string Arguments)> Calls { get; } = new();
+
+    public Task<(int ExitCode, string Output)> RunAsync(string fileName, string arguments, string? workingDirectory, CancellationToken ct)
+    {
+        Calls.Add((fileName, arguments));
+        var response = _responses.Count > 0 ? _responses.Dequeue() : (0, "");
+        return Task.FromResult(response);
+    }
+}