fix: isolate notification endpoints by invocation

[PLN]

Two managers starting Type=notify units with the same name contend for one global named pipe, and restarts reuse that address. Bind each listener to the existing invocation ID. Clients consume the injected WINUNIT_NOTIFY_PIPE; their protocol and process/job authorization are unchanged.

Validation:

• The native regression fails on the previous implementation and passes three times with this change. It runs equal unit names in independent managers with simultaneous watchdog traffic, restarts one, rejects its stale endpoint, and checks process cleanup. The full local race-enabled suite passes.
• Exact-source CI 34815323517, attempt 2 passed for ab95a79. Attempt 1 hit an existing journal test's one-second recovery timeout; that test subsequently passed 30 local race-enabled repeats with GOMAXPROCS=1 and the full CI retry. Both outcomes are retained.
• Verified immutable Windows artifact on disposable Enterprise LTSC build 26100: the same notify unit ran under two standard-user S4U managers and SYSTEM at once. All three sustained READY/WATCHDOG operation beyond one watchdog interval. Five workload invocations and 41 ownership snapshots cover initial launch and each user's manager crash. Replacements completed in 1.192s and 9.626s while peer and SYSTEM invocation identities stayed stable. Both old endpoints were absent after replacement; all three live endpoints rejected an outside SYSTEM process before the acceptance banner.
• Cross-user control/private-file access denial, target profile/environment/HKCU checks, independent revocation, no resurrection, account/profile/process/linger cleanup, exact filesystem ACL restoration, and original broker restoration passed.

The first lab fixture attempted user-control queries before READY during enabled-unit boot and could not complete its restart check. It restored the guest and is retained as incomplete. The accepted fixture sends READY before those queries. User control availability during pending boot is a separate follow-up. The broader R4 interactive matrix remains open.