feat(sandbox): Windows ACL write-restriction sandbox (restricted-token runner)

Confine Windows command execution through a WRITE_RESTRICTED token whose restricting SIDs carry an orphan-SID write allowlist, ported from https://github.com/huoyaoyuan/windows-acl-restrict-poc (@ 10e4dfb). Every Win32 call is checked and fails closed - the POC silently ran children with the FULL token when CreateRestrictedToken failed.

- @deepseek-ai/dsh-sandbox-windows-acl: koffi primitives verified against the MinGW Windows headers (verify/abi-probe.cpp) plus the confinement runner ([node, runner, --workspace, --temp, --mode, --, argv...]: kill-on-close job, stdio passthrough, exit-code mirroring, windows-acl-run: failure signature, grant revocation). read-only = strict zero grants (NUL device not writable; documented). Windows-only execution: exempted from the Linux coverage lane (windowsOnlyCoverageExclusions).
- @deepseek-ai/dsh-sandbox-local: PLATFORM_CHAINS.win32 filled with the windows-acl runner (full enforcement, ACL denial dialect, runner-failure rules).
- @deepseek-ai/dsh-pwsh-sandbox: sandbox-consuming pwsh executor (call-for-call mirror of dsh-bash-sandbox) over a new argv-level seam in dsh-pwsh-local; per-file coverage complete via the fake-provider spec.
- bundle/base: the Windows platform layer mounts the confined pwsh roster - sandbox/policy/fs-sandbox/permission/approval re-enabled, the POSIX bash stack stays disabled.

Co-authored-by: Huo Yaoyuan <huoyaoyuan@hotmail.com>

packages/bundle/base/tests/base.spec.ts

@@ -30,7 +30,7 @@ describe('dsh-base bundle', () => {
     expect(rows.some(row => row.id === 'agent-loop')).toBe(true)
   })
 
-  it('ships the Windows platform layer as the documented danger-full-access roster', () => {
+  it('ships the Windows platform layer as the confined pwsh roster over the ACL runner chain', () => {
     const root = fileURLToPath(new URL('..', import.meta.url))
     const parsed = yaml.load(
       readFileSync(resolve(root, 'windows.cordis.patch.yml'), 'utf8'),
@@ -44,30 +44,20 @@ describe('dsh-base bundle', () => {
     const disables = parsed
       .filter(patch => patch.disabled === true)
       .map(patch => patch.id)
-    // The POSIX-only sandboxed stacks leave the Windows roster as one unit:
-    // shell (bash-sandbox/tool-bash), the permission switcher it requires,
-    // the fs/sandbox policy stack whose OS runners do not exist on win32,
-    // and the approval service — nothing on Windows asks for approval, so
-    // the model is never told approval exists or that asks auto-reject.
-    expect(disables).toEqual(
-      expect.arrayContaining([
-        'bash-sandbox',
-        'tool-bash',
-        'permission',
-        'ui-permission',
-        'sandbox',
-        'sandbox-policy',
-        'fs-sandbox',
-        'approval',
-      ]),
-    )
+    // Only the POSIX bash stack is disabled: the Windows roster confines the
+    // pwsh executor through the ACL runner chain, so the sandbox/policy rows,
+    // the permission switcher, fs-sandbox, and the approval service all stay
+    // enabled exactly as on POSIX — only the shell is swapped.
+    expect(disables).toEqual(['bash-sandbox', 'tool-bash'])
     const inserted = parsed
       .flatMap(patch => patch.insert ?? [])
       .map(row => row.id)
-    expect(inserted).toEqual(
-      expect.arrayContaining(['pwsh-local', 'tool-pwsh', 'fs-local']),
-    )
-    // Full danger-full-access degradation: no approval surface at all.
-    expect(parsed.find(patch => patch.id === 'approval')?.config).toBeUndefined()
+    expect(inserted).toEqual(['pwsh-sandbox', 'tool-pwsh', 'fs-local'])
+    // The patch no longer touches the permission/approval surface at all.
+    expect(parsed.find(patch => patch.id === 'approval')).toBeUndefined()
+    expect(parsed.find(patch => patch.id === 'permission')).toBeUndefined()
+    expect(parsed.find(patch => patch.id === 'sandbox')).toBeUndefined()
+    expect(parsed.find(patch => patch.id === 'sandbox-policy')).toBeUndefined()
+    expect(parsed.find(patch => patch.id === 'fs-sandbox')).toBeUndefined()
   })
 })