feat(sandbox): Windows ACL write-restriction sandbox (restricted-token runner)

Confine Windows command execution through a WRITE_RESTRICTED token whose restricting SIDs carry an orphan-SID write allowlist, ported from https://github.com/huoyaoyuan/windows-acl-restrict-poc (@ 10e4dfb). Every Win32 call is checked and fails closed - the POC silently ran children with the FULL token when CreateRestrictedToken failed.

- @deepseek-ai/dsh-sandbox-windows-acl: koffi primitives verified against the MinGW Windows headers (verify/abi-probe.cpp) plus the confinement runner ([node, runner, --workspace, --temp, --mode, --, argv...]: kill-on-close job, stdio passthrough, exit-code mirroring, windows-acl-run: failure signature, grant revocation). read-only = strict zero grants (NUL device not writable; documented). Windows-only execution: exempted from the Linux coverage lane (windowsOnlyCoverageExclusions).
- @deepseek-ai/dsh-sandbox-local: PLATFORM_CHAINS.win32 filled with the windows-acl runner (full enforcement, ACL denial dialect, runner-failure rules).
- @deepseek-ai/dsh-pwsh-sandbox: sandbox-consuming pwsh executor (call-for-call mirror of dsh-bash-sandbox) over a new argv-level seam in dsh-pwsh-local; per-file coverage complete via the fake-provider spec.
- bundle/base: the Windows platform layer mounts the confined pwsh roster - sandbox/policy/fs-sandbox/permission/approval re-enabled, the POSIX bash stack stays disabled.

Co-authored-by: Huo Yaoyuan <huoyaoyuan@hotmail.com>

packages/bundle/base/windows.cordis.patch.yml

@@ -1,26 +1,19 @@
 # The dsh-base Windows platform layer: applied by the dsh launcher on win32
-# hosts, between the bundle layers and the user layers. Windows cannot run
-# the POSIX-only sandboxed stacks, so this layer swaps the shipped bash stack
-# for the PowerShell stack AND drops the whole permission surface: no OS
-# runner exists on Windows (landlock/bwrap/seatbelt are POSIX-only), so any
-# policy would be theater — the unconfined shell could bypass fs-only path
-# rules with one command. Windows therefore degrades to danger-full-access:
-# unconfined pwsh + unconfined fs (`dsh-fs-local`), no permission switcher
-# (dsh-permission requires a confining executor), and no approval service —
-# nothing in the roster asks for approval, and the model is never told
-# approval exists or that requests are auto-rejected.
-# The launcher reads THIS file from the base bundle package (never through
-# dsh.bundle.patch — that field names the one universal layer). A Windows
-# host that prefers bash or confinement overrides these rows through its
-# profile or home cordis.patch.yml.
-# The bash-restore recipe must be complete: disable pwsh-local and tool-pwsh
-# AND re-enable bash-sandbox and tool-bash (plus permission/ui-permission only
-# if the switcher is wanted) — both executors register the same 'bash'
-# service, so re-enabling the bash rows while pwsh-local stays inserted fails
-# loud at load on a duplicate registration.
-# The ui-permission disable targets a row owned by dsh-web-app, not dsh-base:
-# a base-only profile (e.g. the `dsh plugin --profile` default template) has
-# no such row, and the no-match logs a harmless warning on every load.
+# hosts, between the bundle layers and the user layers. Windows confines
+# through the ACL restricted-token runner (the win32 chain of
+# dsh-sandbox-local → @deepseek-ai/dsh-sandbox-windows-acl), so the shipped
+# stack is the SANDBOXED PowerShell executor plus the full permission
+# surface: sandbox/sandbox-policy enforce the file-effect policy, the
+# permission switcher and the approval service run exactly as on POSIX, and
+# fs-sandbox fences the in-process filesystem view. Only the POSIX bash
+# stack (bash-sandbox/tool-bash) is disabled — bash has no Windows runner.
+# A Windows host that prefers the unconfined local pwsh executor or full
+# access overrides these rows through its profile or home cordis.patch.yml.
+# The bash-restore recipe must be complete: disable pwsh-sandbox and
+# tool-pwsh AND re-enable bash-sandbox and tool-bash — both executor
+# families register the same 'bash' service, so re-enabling the bash rows
+# while pwsh-sandbox stays inserted fails loud at load on a duplicate
+# registration.
 
 - id: bash-sandbox
   disabled: true
@@ -28,27 +21,9 @@
 - id: tool-bash
   disabled: true
 
-- id: permission
-  disabled: true
-
-- id: ui-permission
-  disabled: true
-
-- id: sandbox
-  disabled: true
-
-- id: sandbox-policy
-  disabled: true
-
-- id: fs-sandbox
-  disabled: true
-
-- id: approval
-  disabled: true
-
 - insert:
-    - id: pwsh-local
-      name: '@deepseek-ai/dsh-pwsh-local'
+    - id: pwsh-sandbox
+      name: '@deepseek-ai/dsh-pwsh-sandbox'
 
     - id: tool-pwsh
       name: '@deepseek-ai/dsh-tool-pwsh'