Let an explicit MaxInstancesToLaunch beat DiffEngine_MaxInstances

[SimonCropp]

DiffEngine_MaxInstances was read ahead of the app domain value, and it persists per user - the tray writes it to the user environment on every settings save. So on a machine that had ever saved tray settings, DiffRunner.MaxInstancesToLaunch silently did nothing, and a test calling it to keep diff windows shut still had them open.

Read the app domain value first, as DiffRunner.Disabled already does for an explicit set, leaving the environment as the ambient default for a run that sets nothing.

Two things behind that, in SetForUser:

• A save that changes nothing writes nothing. Write is handed whatever the options form was populated with, which is the value already in effect, and unrelated saves come through the same path - the "always kill locking processes" prompt persists itself that way and has no options form at all. Opening the tray once was enough to leave a user scope variable behind on a machine that had never chosen a limit.
• Choosing the default clears the variable rather than persisting it, as SetTargetOnLeft does with false, so there is a way back to an unset machine through the options form.

Tests wrote the user environment of the machine running them, and could not put it back reliably: the test projects run as parallel processes over the one registry key, so a capture in one and a restore in the other race. EnvironmentHelper.Set is now swappable, and both test module initializers keep those writes inside the process.