CPU topology v2 phase 4: add safe CpuSelection affinity apply path (#10)

Add safe CpuSelection affinity apply path

Introduce a structured CpuSelection affinity apply path that tries CPU Sets first and falls back to legacy ProcessorAffinity only when the selection is safely representable as a non-zero single-group <64 mask.

- Add structured AffinityApplyResult fields and error codes
- Add CpuSelectionAffinityApplier with CPU Sets-first behavior
- Add ProcessService overload for CpuSelection affinity apply
- Block unsafe legacy fallback for multi-group and CPU >=64 selections
- Preserve existing legacy SetProcessorAffinity(long) behavior
- Add audit coverage for CpuSelection apply success/failure paths
- Add tests for safe fallback, blocked fallback, access denied, process exit and invalid selection

No UI, preset generator, profile migration, registry/IFEO, priority guardrail, versioning or tag changes.

Author: PrimeBuild-pc