fix(pipe): bind loaded notices to process identity

[wmetcalf]

Summary

• include the current process creation FILETIME in successful monitor-load acknowledgements
• preformat the 64-bit identity before passing it through CAPEMON's intentionally limited pipe() formatter
• preserve the legacy LOADED:<pid> fallback if the process identity cannot be obtained or formatted
• emit identity-tagged acknowledgements only when the analyzer advertises support in the monitor config
• update the Windows Actions runner and install the required Visual Studio v141 toolset so both native architectures build in CI

Why

The analyzer needs to distinguish a delayed monitor acknowledgement from a new process that reused the same numeric PID. The creation FILETIME provides that instance identity.

Compatibility

The analyzer and monitor negotiate the tagged protocol. Either repository PR may be merged or deployed first: an older analyzer does not write the capability, so this monitor sends legacy LOADED:<pid>; the updated analyzer also accepts legacy acknowledgements from an older monitor. Identity validation activates when both sides are updated.

Companion CAPEv2 PR: kevoreilly/CAPEv2#3211

Verification

• Windows MSBuild CI passed for Win32/x86 and x64 on commit c447d8b (run 34073283202)
• adversarial Marla review of the final native delta — AGY, Codex, and Qwen returned no findings
• live Windows 11 regression using the original missed sample, CAPE task 18647:
  • WmiPrvSE and all three PowerShell children emitted valid load acknowledgements
  • zero malformed-format, pipe-handler, stale-identity, or injection-failure errors
• mixed-version Windows 11 tests on toolz4:
  • task 18734: pre-capability analyzer + this CAPEMON — three PowerShell children loaded, zero protocol errors
  • task 18735: updated analyzer + legacy CAPEMON — three PowerShell children loaded, zero protocol errors
  • task 18736: updated analyzer + this CAPEMON — three PowerShell children loaded, zero protocol errors