Add local server state machine subprocess tests

[sdairs]

Summary

• add one table-driven, isolated subprocess suite for the local ClickHouse server state machine
• cover fresh, default, custom, omitted/explicit selection, exact-CWD, explicit global project, and generated-name transitions
• exercise bare starts through a selected fake latest default without network resolution
• assert exact output contracts, metadata, process liveness, data persistence/removal, telemetry isolation, update-cache isolation, and no project server state under HOME

Tests

• cargo test -p clickhousectl --test local_server_state_machine_test (3 runs, including 2 concurrent runs)
• cargo build --workspace
• cargo check --workspace --all-targets
• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace (blocked by two inherited parent-owned help-text assertions in local::cli::tests; those files are outside this PR diff)

Closes #479

Supersedes #521.

[sdairs]

Carry-over review from PR #521 (old PR for #479). This PR is strictly better than #521: CI green where #521 is red; it fixes #521's fatal exec sleep × managed-identity-inspection interaction by construction (the new base uses plain kill(pid, 0) liveness, and all pgrep/lsof/ps discovery is shimmed at the front of PATH keyed off a recorded pid file, so global-discovery scenarios are deterministic); stronger isolation (env_clear() + per-scenario fixtures + ProcessGuard + no-recorded-PID-alive check); exact full-JSON equality for responses and structured errors plus exact-string human output; full metadata-file equality; data-marker persistence across restart; and explicit --global --project <root> stop from a child CWD. Verified: suite passes locally (1 passed). No sdairs over-engineering/test-design comments existed on #521. Three items before merge:

1. Honor sdairs' one substantive review comment on Add local server state machine subprocess tests #521: "always use latest". On Add local server state machine subprocess tests #521, sdairs' comment was "always use latest" (addressed there by installing and selecting a fake latest default and starting without --version, keeping determinism without network resolution). This PR does the opposite: const VERSION: &str = "25.12.9.61" and every start appends --version 25.12.9.61 --no-wait. Determinism is preserved (local-first install finds the pre-seeded version) so the spirit is honored, but the bare-start / default-version-resolution path (get_default_version() → bare start) is never exercised, and the literal instruction is not followed. Either add a bare-start case backed by a fake latest default (write .clickhouse/default + a versions/latest copy of the fake binary), or document in the PR description why pinning the version is intentional.

2. Add the omitted-repeated-start → generated-name transition. Add local server state machine subprocess tests #521 covered it ("omitted repeated start generates a name"); this PR does not exercise resolve_name_locked's random adjective-noun generation anywhere. That is a real state-machine transition named in the acceptance criteria ("repeated start"). Add a case asserting a generated name is produced and usable for subsequent stop/remove.

3. Seed the update-check cache to prevent a latent flake. This PR's exact human-stderr assertions don't account for the cached update notice. Add local server state machine subprocess tests #521 seeded last_update_check; this PR does not. Today latest release (v0.4.1) == CARGO_PKG_VERSION so is_newer is false and nothing prints — but once v0.4.2 ships, every HumanSuccess/HumanFailure case gains a stderr suffix and fails. Seed the cache as Add local server state machine subprocess tests #521 did.

Minor: #521 also asserted project server state is never written under HOME; consider adding that assertion here.

Supersede/close #521 when this merges.