fix active response process identity validation

[Karib0u]

Summary

• add process identity capture with PID, image path, process start time, and optional command-line hash
• re-query live process identity immediately before active-response termination
• skip and log active responses when the live process no longer matches the alert identity

Root cause

Active response made the termination decision from the PID and image stored in the alert context. If that PID was reused before the worker executed, termination could target a different process.

Validation

• cargo test --no-run
• cargo test --test active_response
• cargo test response::tests::validate_process_identity

Windows target compile was attempted locally, but x86_64-pc-windows-msvc is not installed on this machine.