fix(sandbox): drop Authenticated Users from both restricting lists — close the C:\\-root escape, CIM unavailable in every confined mode

workspace-write now runs [logon SID, Everyone, orphan]: the two lists differ only by the orphan, and the keep-alive group (logon SID + Everyone) is the single shared invariant. The WMI namespace security check fails in BOTH modes (0x80041003), so CIM/Get-ComputerInfo are unavailable everywhere — the price of closing the C:\\-root tree-creation escape (AU:(AD) + AU:(OI)(CI)(IO)(M)) in workspace-write too. The unused WinLocalSid/WinInteractiveSid/WinAuthenticatedUserSid constants and their ABI-probe prints are removed; the enforcement 'full' claim now stands on a closed NTFS surface. New regression: a C:\\Users\\Public subdirectory write is denied under BOTH modes (the ambient-writable blind spot the review flagged — INTERACTIVE is absent from both lists). FAT-class (non-ACL) targets outside the granted roots remain writable (no security descriptors to intersect) — documented as a legacy residue, warn-only, not engineered around. Docs/design note/PR body updated in both languages (list I/J terminology gone everywhere).

packages/sandbox/sandbox-local/tests/acl-session.spec.ts

@@ -199,7 +199,7 @@ describe('windows-acl per-session grant (LocalSandboxProvider)', () => {
       expect(mockState.grants).toHaveLength(1)
 
       // Downgrade: the standing grant is KEPT — never revoked, never
-      // re-granted. The read-only restricted token's list I carries no
+      // re-granted. The read-only restricted token's list carries no
       // orphan SID (pinned by the windows-acl runner regression), so the
       // ACE is inert under read-only while the map hit keeps the
       // re-upgrade free of eager propagation.