fix(sandbox): drop Authenticated Users from both restricting lists — close the C:\\-root escape, CIM unavailable in every confined mode

workspace-write now runs [logon SID, Everyone, orphan]: the two lists differ only by the orphan, and the keep-alive group (logon SID + Everyone) is the single shared invariant. The WMI namespace security check fails in BOTH modes (0x80041003), so CIM/Get-ComputerInfo are unavailable everywhere — the price of closing the C:\\-root tree-creation escape (AU:(AD) + AU:(OI)(CI)(IO)(M)) in workspace-write too. The unused WinLocalSid/WinInteractiveSid/WinAuthenticatedUserSid constants and their ABI-probe prints are removed; the enforcement 'full' claim now stands on a closed NTFS surface. New regression: a C:\\Users\\Public subdirectory write is denied under BOTH modes (the ambient-writable blind spot the review flagged — INTERACTIVE is absent from both lists). FAT-class (non-ACL) targets outside the granted roots remain writable (no security descriptors to intersect) — documented as a legacy residue, warn-only, not engineered around. Docs/design note/PR body updated in both languages (list I/J terminology gone everywhere).

packages/sandbox/sandbox-local/src/index.ts

@@ -381,7 +381,7 @@ export class LocalSandboxProvider extends SandboxProvider {
    * NOTHING — its token alone restricts every write, and a standing grant
    * from an earlier workspace-write period is KEPT through a downgrade
    * (never revoked): the read-only restricted token carries no orphan SID
-   * (list I), so the ACE is inert there, while the map hit keeps the
+   * (the read-only list), so the ACE is inert there, while the map hit keeps the
    * re-upgrade free of re-propagation. Fail-closed: a half-materialized
    * grant is revoked before the error propagates.
    * @param record - the session's durable record.