Use native process time for Windows embedding snapshot

[TheGreenCedar]

Context

PR #1070 replaced the Windows exact native embedding start-identity query with OpenProcess and GetProcessTimes. Exact packaged proof showed that immediate identity capture now succeeds, but the later process snapshot still fails because its PowerShell/CIM CreationDate conversion does not produce StartedAtEpochMs on the live Windows host.

Acceptance

• Source the Windows snapshot's approximate start time from the same native creation FILETIME.
• Keep CIM only for executable path and command line.
• Preserve the serialized windows:<ticks> identity and PID-reuse checks.
• Add no dependency, retry, schema, or non-Windows change.
• Pass focused Windows tests and exact packaged Windows x64 Vulkan proof.

Refs #1039
Refs #1052