[albertospelta]

Summary

The global exception handler is now installed right after the WinForms configuration, before directory and proxy
setup, the WebView2 runtime check and the bootstrap. A failure anywhere in startup, including an unreadable policy
registry key, now produces a saved report and a visible message instead of ending the process silently.

Changes

• Program installs the handler before every other startup step. Until the bootstrap services exist, a fatal
  exception is saved to the report and shown in the dialog, without logging, telemetry or the Send button.
• BootstrapContextFactory attaches the logger and telemetry to the handler when it creates the context;
  BootstrapContext detaches them before disposing them, so a late crash never uses disposed services. A detach
  releases only the services it attached.
• If the task dialog fails, for example because a type it reads failed to initialize, a plain message box shows the
  error and the report path. The failure is logged once services are attached and no longer ends the process through
  FailFast.
• The report folder is resolved only when a report is saved, so a failing AppEnvironment initialization still
  produces a dialog.
• NullTelemetryService, used when telemetry cannot be created, counts as no telemetry: the dialog no longer offers a
  Send that always fails.
• docs/design/diagnostics.md, docs/design/architecture.md and the consequences of ADR 0003 and ADR 0005 describe
  the new startup coverage.

Testing

• Unit tests cover the handler before and after the services are attached, after they are detached, a failing dialog,
  an unavailable report folder and the attachment owned by BootstrapContext.
• Manual: Debug build with BRAVO_CrashTest=startup (dialog before the bootstrap, no Send) and BRAVO_CrashTest=ui
  (dialog after the bootstrap).