Improve dump triage provenance and metadata

[Marc-André Moreau (mamoreau-devolutions)]

This strengthens read-only dump triage so historical crash correlations expose bounded evidence without promoting dump-load events, stack participation, or unsupported layouts into causation.

• Distinguish third-party stack participation from driver causation and allow immutable dump targets to expose their stored snapshot event.
• Add signature-gated, bounds-checked MDMP header/directory inventory with explicit documented stream presence. Kernel PAGE dumps are reported as not applicable; stream payloads and unknown streams are never decoded.
• Add bounded captured-event instruction offset/code requests (up to 64 bytes), including IDebugAdvanced2 compatibility fallback. Results are mechanically compared with documented bugcheck P2 and remain metadata-only; documented E_NOINTERFACE becomes an explicit invalid captured-event-code-memory status.
• Add regression coverage for the format gate, directory range validation, known/unknown stream inventory, and evidence grading contract.

Validation: cargo fmt --check, cargo test -p windbg-dbgeng -p windbg-tool, cargo clippy --workspace --all-targets -- -D warnings, and cargo build -p windbg-tool.