feat(windows-etw): alert when an ETW provider is disabled while running

[Karib0u]

Problem

An administrator can keep rustinel-etw-trace or rustinel-etw-process running but turn off a provider inside it, for example:

logman update trace rustinel-etw-trace --p Microsoft-Windows-Kernel-Registry 0 0 -ets

The session stays alive, heartbeats keep flowing, and that telemetry family goes silent with no alert.
A session that stops entirely already makes the agent exit, which the shutdown alert covers; a disabled provider is the case nothing reports.

Proposal

• Record the expected provider set per session at startup: GUID, level, keywords, and the registry CapturedData filter.
• Every 30 s, off the ETW callback threads, enumerate the providers enabled on each session (EnumerateTraceGuidsEx with TraceGuidQueryInfo) and compare.
• On any difference, emit agent::tamper::etw_provider_modified (high) naming the session, provider, and what changed. Emit once per change, not on every check.
• Count checks and mismatches in telemetry.json.

Acceptance criteria

• Disabling each provider with logman update produces the alert within one check interval.
• Changing a provider's keywords or level produces the alert.
• No alerts during a 24-hour soak on a lab host.
• Documented in docs/output.md.

Out of scope

Automatically re-enabling providers, silence heuristics, and user-mode ETW patching in other processes.