Fix Windows/macOS CI: profiler MSVC /WX warnings; drift-proof profiler-cost gate

[offdev]

Fixes the two P0 jobs broken by the M1-PROF-01 merge (#47): windows-msvc (build) and macOS arm64 (test). All other jobs in the failed run were green.

1. windows-msvc — build failure in the new profiler code

profiler.cpp (new in #47) had never been compiled under MSVC's /W4 /WX. The CI log's exact warning set:

• C4244 (treated as error): the seven uint64_t counters implicitly converted to double at JsonValue::fromNumber in formatProfileJson (ticks, frames, draw_calls, texture_binds, net_bytes, sim_allocs, system runs; the uint32_t fields convert exactly and are left alone). Fixed with explicit static_cast<double> + the per-line LAIGE-DETERM-EXCEPTION marker for the double token (determinism-lint policy; the existing stats.n cast precedent).
• C4996 (treated as error): plain std::fopen in writeProfile. Fixed with a portable openProfileFile helper following the _fsopen(..., _SH_DENYNO) precedent of replay.cpp / config.cpp / logging.cpp (plain-fopen sharing semantics — fopen_s would open _SH_SECURE and deny re-open).
• Latent, same class: profiler_tests.cpp used plain std::fopen in readFile/fileExists — it never compiled on Windows in the failed run because the build stopped at profiler.cpp. Same precedent via an openReportFile helper (replay_record_tests.cpp precedent).

2. macos-arm64 — ProfilerCost.EnabledCostBoundedToOnePercent at 2.14% vs the 1% gate

on_p50=0.260291 off_p50=0.254833, while the canonical baseline of the same measurement is 0.28% — the profiler's fixed per-tick cost (two steady_clock reads + one O(1) ring write) is far below 2% of any supported platform's 10k-entity tick. Root cause: the original BLOCKED arm order (all ON runs before all OFF runs) measured the two arms in two different phases of the CI runner's frequency/thermal drift under sustained load — the drift itself showed up as overhead, one direction only.

Verified locally on the baseline's own CPU (Ryzen 7950X3D, sustained load): the blocked order spread -1.9% … +1.3% across 10 runs while the true overhead is ~0.03–0.08%. (Per-run best-of-N interleaving was tried first and still spread ±1% — the phase noise lives on a seconds scale, not a run-pair scale.)

Fix: per-tick A/B interleaving — the profiler is enabled on every other tick (runtime setEnabled, the DBG-002 switch), so each ON sample is adjacent (~1 ms) to an OFF sample; both subsequences sample the same machine-state trajectory and the phase cancels at the adjacent-sample level. A transient CI stall slows at most one tick = one sample of 2000 in one window — no p50 effect, so no best-of-N repetition is needed. After the fix: 10/10 runs at -0.01% … +0.08% (12–30× inside the gate). The 1% gate, the workload, and the machine-greppable profiler-cost line format are unchanged.

Verification (local)

• canonical g++ and clang++ trees: zero-warning builds, full ctest 89/89 green (incl. profiler, api-real-tree, determinism-lint-real-tree, laige_run_smoke)
• ASan tree: zero-warning build, profiler suite green (the ProfilerCost gate stays excluded from sanitizer trees — the LAIGE_ALLOC_COUNTER gate, unchanged)
• include-lint + determinism-lint OK; no public API surface change (laige-api.json untouched)
• the 12 hello_* failures of the first local run were a race on the shared samples/hello/bin/ binaries (three local trees building the same source-tree path in parallel — CI checkouts are isolated); sequential per-tree runs are green
• MSVC and AppleClang cannot run here — verified through this PR's ci:windows / ci:macos jobs (labelled in order; see run history)