fix(service): explain a startup core rejection instead of the generic fallback

When the startup probe finds the service refusing the approved core, the
app falls back to Sidecar with only the generic "could not start the
core" notice. The reason and repair guide appeared only after a
reinstall, which cannot fix a writable volume root (#8045).

Carry the fallback reason to the window and show the same permission
notice as a rejected installation when the core was refused.

Refs #8045

Changelog.md

@@ -22,4 +22,8 @@
 <summary><strong> 🚀 优化改进 </strong></summary>
 
 
+**🖥️ Windows**
+
+- 优化 Windows 服务安全检查未通过时的启动提示：显示具体原因，并提供修复文档链接
+
 </details>