fix: make cutover restart argv upgrade-safe and tests platform-honest

- cutover-orchestrator: restart via 'node --import tsx' (matching install.sh)
  instead of a hardcoded .pnpm/tsx@4.22.4 loader path that breaks on tsx bumps
- production-gateway: use process.execPath for the legacy-start fixture;
  POSIX-only 0600 mode assertion now win32-guarded
- cli-runtime + installer suites: skip where they require POSIX-only
  process-group SIGTERM, lsof, or /bin/sh
- fixture-safety: fall back to config.example.json when config.json is absent
  on a fresh clone

packages/test-fixtures/test/fixture-safety.test.ts

@@ -221,7 +221,14 @@ test('real fixtures satisfy envelope, registry, leak scan, and manifest integrit
   const files = (await jsonFiles(fixtureRoot)).filter((x) => !x.includes('/synthetic-errors/'));
   const srcEntries = await readdir(path.join(root, 'src'));
   assert.ok(!srcEntries.includes('synthetic-errors'));
-  const config = JSON.parse(await readFile(path.resolve(root, '../../config.json'), 'utf8'));
+  // config.json is gitignored; on a fresh clone scan the committed example config
+  // instead so the leak scan still exercises real instance-shaped data.
+  const configPath = path.resolve(root, '../../config.json');
+  const configText = await readFile(configPath, 'utf8').catch((error) => {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    return readFile(path.resolve(root, '../../config.example.json'), 'utf8');
+  });
+  const config = JSON.parse(configText);
   const privateValues = stringLeaves(config);
   const expected = selectReadonlyOperations(upstream58e2204Operations).selected;
   assert.equal(files.length, expected.length * 2);