test(windows): close packaged sandbox lifecycle evidence

[liugddx]

Summary

This PR closes the remaining automated lifecycle evidence for the packaged Windows 11 x64 W1 sandbox surface tracked by #2142.

It adds one end-to-end packaged verifier path for:

• Runtime Host parent death during a live FilesystemWorkerClient launch;
• broker owner binding and kill-on-close AppContainer Job drain;
• an 8-wave, 8-way (64 launch) concurrency soak with disjoint request identities;
• quarantined ACL-ledger non-reuse and preservation-for-inspection;
• a malicious AppContainer child matrix covering filesystem aliases, restricted network, host named pipes, ambient environment, host registry values, parent-token access, and descendant AppContainer/Job inheritance.

The local broker now binds --broker-local to its kernel-observed direct parent process. It keeps a wait handle for that Runtime Host owner and interrupts the first launch when the owner exits, routing the outcome through existing Job settlement and ACL-ledger cleanup. No PID is used as termination authority.

This is a release-evidence and lifecycle hardening PR for the shipped filesystem-worker surface. It does not claim the wider W2 general-command tier or full Windows support.

Deferred boundaries

The following remain explicit follow-up gates:

• Authenticode identity verification;
• direct Credential Manager/DPAPI probes;
• no-Win32k mitigation;
• dedicated window-station and clipboard isolation;
• power-loss automatic recovery;
• independent human security review.

Rows outside the W1 preview surface remain fail-closed and are not counted as passing evidence.

Verification

Local exact-head verification:

• npm run lint: passed;
• npm run format:check: passed;
• npm --workspace @maka/core run build: passed;
• npm --workspace @maka/storage run build: passed;
• npm --workspace @maka/mcp run build: passed;
• npm --workspace @maka/runtime run build: passed;
• npm --workspace @maka/runtime-host run build: passed;
• Windows sandbox/broker/process-runner suites: 17 passed, 0 failed, 1 POSIX-only skip;
• scripts/verify-windows-harness.test.mjs: 39 passed, 0 failed, 1 symlink-privilege skip;
• PowerShell syntax, Rustfmt, and git diff --check: passed.

The full workspace typecheck has pre-existing CLI/UI/Desktop baseline failures unrelated to this diff. Native broker linking is authoritative in the Windows CI lane; this machine lacks dlltool/MSVC link.exe.

The exact-head est lane is currently red in the pre-existing packages/eval/harbor/test_relay_lifecycle.py test (late_write remained present); the PR does not modify packages/eval. The affected standard workspace run reported 935 passed / 0 failed / 16 skipped, with only that independent 14-test eval sub-suite failing.

Scope

Refs #2142. This PR supplies the automated evidence needed before the Phase 4 lifecycle checkbox can be closed; independent maintainer/security review remains required.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented the narrow packaged lifecycle and adversarial evidence slice, added the Runtime Host owner-death binding, updated the EN/zh RFC and Windows support boundary, and ran the local quality gates. AI review is not independent human security review.

Checklist

• Tests cover the change and fail without it
• Lint, format, affected builds, and local suites pass
• Fresh packaged Windows L3 passes on exact head 6970405e99a7e0aaba28c1f5eb30227aeb57b320 (package run 32752021945); W0 protocol also passed (run 32752021175)
• Independent human security review is complete

Does this PR entail a change in behavior?

• Yes - the packaged one-shot broker now drains its AppContainer Job when its Runtime Host owner exits; the release verifier runs the remaining W1 lifecycle and adversarial scenarios.
• No

[Astro-Han]

I reviewed this head and found no blocking issues.

The packaged sandbox evidence path correctly handles broker parent-handle ownership, Job drain, ACL quarantine, and adversarial matrices without auth bypass. Hosted checks for test, package, and windows_sandbox_w0_protocol are success, with 40/40 harness sources covered.

No P0-P3.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 224a981, no P0-P3, security boundary verified.