[kingchenc]

Windows blocks drag & drop from Explorer into an elevated window, so asking
users to restart Diskghost as administrator for the MFT engine broke dropping
folders. The window now never runs elevated:

• On the first Ultra scan the app starts its own executable once more with
  --mft-helper, elevated after a single consent prompt per session and
  without a window. The helper reads the drive's Master File Table and hands
  each scan back as a snapshot, from which the app rebuilds the tree
  (Snapshot::to_tree, ScanTree::set_engine / mark_cancelled) and which it
  reuses for the scan's history instead of capturing it again.
• They talk through files in a private folder (request, progress, cancel,
  result, done). Each request must carry a random token that only the app and
  the helper know (it travels on the elevated command line); request ids are
  digits only; the helper only reads disks and writes into its folder under
  fixed names, ignores anything else, and quits ~20 s after the app stops
  touching its heartbeat. If anything fails the scan falls back to the
  directory walk and the reason is shown.
• Tested end to end with real elevation: a forged request is ignored, a scan
  of C:\Users\me through the helper takes 32 s with the MFT engine and reads
  back correctly, and the helper exits after the app goes away.
• Progress no longer counts MFT records as files.
• The restart-as-administrator command and button are gone; the settings
  explain the one-time prompt. When the app is started elevated anyway, the UI
  adapts: no drag & drop invitations, the drop hint explains why and points to
  pasting a path, Browse and the drive list.

Core: Progress::set_counts for progress reported from another process,
Snapshot::to_tree with a round-trip test (35 core tests).