Pin delete-instance cross-instance safety (G4h: Alpha delete leaves Beta intact)

Summary

• G4h mirrors G3h's --purge cross-instance safety pin at the lower-level delete-instance command. Same destructive recursion logic (Path.GetDirectoryName on cert path, Directory.Delete recursive guarded by IsSafeInstanceDir); pinning both surfaces ensures any regression in the shared safety guard breaks at least one test.
• Operator scenario: a host runs Alpha (decommissioned) + Beta (live production). sudo squid-tentacle delete-instance --instance Alpha MUST leave Beta fully untouched — if Beta's cert dir gets nuked, polling silently breaks hours later.

Test mechanism

1. Register Alpha + register Beta (no service install needed — keeps test scope tight on instance management)
2. delete-instance --instance Alpha
3. Assert Alpha artefacts gone (happy path)
4. Assert Beta config + cert dir + registry entry SURVIVE
5. Assert stdout logs Alpha's deletion specifically; Beta is never mentioned

Test plan

• dotnet build green (0 errors)
• CI passes G4h_DeleteInstanceAlpha_DoesNotDestroyBetaState
• G4h asserts: Alpha config + cert dir gone + Beta config + cert dir + registry entry SURVIVE + log "Instance '{Alpha}' deleted" present + log NOT containing "Instance '{Beta}' deleted"
• Existing 46 Linux E2E tests still pass

🤖 Generated with Claude Code