[Bug]perf: bounded queries can hit full-capture analysis limits before range filtering #1113

Found while validating the performance diagnostics introduced by #837 against PowerToys Settings. Revalidated on current main at 67c262b0.

Describe the bug

perf analyze materializes the full capture before applying marker or time-range filters. A valid bounded scenario can therefore become unavailable when an earlier part of the capture reaches the retained-evidence limit.

To reproduce

1. Record a multi-page PowerToys Settings session with start/end markers around each navigation.
2. Stop the capture normally.
3. Query a scenario near the end:

winapp perf analyze .\capture `
  --from-marker new-plus-start `
  --to-marker new-plus-end `
  --view summary --json

The capture completed with all 24 markers and no ETW loss (eventsLost: 0, buffersLost: 0). Analysis stopped at approximately 45.8 seconds with:

Selected-event or 128-MiB retained-evidence limit reached.

The requested marker starts at approximately 49.9 seconds, so the bounded query fails with:

No complete WinUI activity identifies a primary UI thread in the selected range.

Expected behavior

An explicit marker or time-range query should not require retaining the entire capture. Out-of-range records should be filtered by QPC before detailed decoding, while preserving boundary-overlap coverage.

Environment

• Windows 10.0.26200.0
• PowerToys commit ab799fb086fcd520ccda0807461f46639ca7ecb9
• winapp main commit 67c262b0