fix: bind compiler diagnostic hostfxr directory selection

[hcoona]

The compiler/native-input diagnostic pins hostfxr.dll, but the native host first selects the highest version directory under host\fxr. An added higher directory can therefore select an unbound binary or fail before framework roll-forward applies. The immutable .NET resolver source establishes that selection order.

Require the existing two membership checkpoints to see exactly the three admitted version directories under the fixed hostfxr root. The controller and canonical protocol change together. Existing file-only checks, shared limits and the selected DLL identity remain required. This adds no experiment invocation or installation change; runtime admission still requires the merged protocol and refreshed source and capacity bindings.

Refs #108. Authorized by the accepted First Windows Authentication Slice Delivery Wave entry.

The originating finding was independently triaged by lifetime_triage as a true positive: the current controller rejects directory members, and the retained .NET native resolver selects its maximum version directory before checking that directory's hostfxr leaf. The smallest remedy is this single fixed directory domain, with six additional yielded entries and sixteen metadata probes across two successful checkpoints. Checkpoint observations retain the existing limitation that they do not establish an atomic filesystem snapshot.

Validation: full hk check --all and commit hooks passed, including all 32 runner conformance groups. Independent research-evidence and contextual code review by lifetime_triage, and record-system review by wave_review, reported no material findings. CI must pass before merge. No Windows build, publish or authentication subject has been invoked by this change.

[hcoona]

Independent agent review record for commit ae29cb3, tree 3216ac0e2a8b4db33f7505e8da3176719417701e, against accepted main-v2 e9160c0.

• Reviewer /root/lifetime_triage applied the accepted research-evidence-review Skill and contextual code/scope review. No material findings.
• Reviewer /root/wave_review applied the accepted record-system-review Skill. No material findings.
• Both reviewers were independent of the controller author /root/collector_schema_triage and protocol author /root. The originating missing-hostfxr-selection finding was independently classified by lifetime_triage as a true positive before implementation.

Reviewed controller: 55,115 bytes, SHA-256 dcbd444c895f5785d03fb03f15f986b59d2c91b51da06a23cd358bbcd26bd1c8. Reviewed canonical protocol: 570,330 bytes, SHA-256 e3696bf72e42f5bf8f7471ddad92e5a1e29e9aab9aef881cb50af7d5db88cc5e.

The fixed domain preserves existing file checks, counters, two checkpoints and effects. It establishes checkpoint continuity under the existing workstation premise; it does not claim an atomic snapshot or observed runtime success. The protocol remains the sole canonical authority for this diagnostic and adds no record family, general control, work grant or capacity reset.

Full hk and commit hooks passed, including 32 runner conformance groups. CI and merge remain separate. Later diagnostic execution requires accepted protocol and refreshed source, physical-input and capacity admission; this review does not authorize execution.