fix: make cold Windows recording bounded

[abrichr]

Why

The exact-SHA Production qualification ran the built 1.3.0 wheel in a fresh Windows environment. Native hooks started, but the first pywinauto/comtypes UI Automation setup exceeded the shared five-second limit. The normal Windows test job had warmed those imports before it started the recorder, so it didn't expose the cold path.

The first successful recorder shutdown also spent about 55 seconds building Matplotlib's font cache. Performance plotting was enabled by default even though it is a diagnostic.

What changed

• Keep the native hook startup limit at five seconds.
• Give the Windows delivery/UIA setup its own bounded 20-second limit.
• Make performance plotting opt-in. plot_performance=True still enables it.
• Add contracts for the separate timeout and plotting default/override.

Verification

• 100 focused observer, runtime-contract, and high-level tests passed. Four socket-control tests were excluded because this local sandbox rejects loopback binds.
• 43 release, repository, and source-boundary tests passed.
• The built wheel and source archive passed distribution verification.
• Ruff, changelog validation, source-boundary validation, and git diff --check passed.

The exact-SHA hosted Windows qualification must pass from a fresh built-wheel environment before release.