fix(install): unblock Windows 10 downloads, and make the activation refusal actionable (#1856)

[DeusData]

Two independent Windows install blockers from #1856, whose reporter did the work to find both.

1. The installer hard-failed on every Windows 10 machine

install.ps1 set SecurityProtocol = Tls12 -bor Tls13 unconditionally. Windows 10's schannel has no TLS 1.3 — it arrives with Windows 11 and Server 2022 (build 20348) — but .NET Framework 4.8 still defines the enum value, so the assignment succeeds and nothing warns. The first HTTPS request then dies with The request was aborted: Could not create SSL/TLS secure channel, because an unsupported flag in this bitmask is a hard failure, not a downgrade.

The protocol set is now computed: Tls12, plus Tls13 only on build 20348+. The enum-name probe alongside the build gate keeps the script parsing on .NET Framework 4.7, where the member does not exist at all.

Verified on a real Windows box (build 26200) with the shipped parser:

PARSE_OK
ASCII_ONLY=True nonascii=0
COMPUTED=Tls12, Tls13      # Windows 11 keeps TLS 1.3
WIN10_BRANCH=Tls12         # the same expression at build 19045 drops the bit
HTTPS_OK status=200

2. The refusal named no check, and its remedy could not remove the grant

The reporter captured a full ProcMon trace and still could not say which check refused. That is not their failing — the binary discards the answer before printing it.

cli_activation_production_context_init() validates the cache, rendezvous and log directories, so it is the emitter most likely to hold a useful detail. It printed CLI_ACTIVATION_REFUSED_MESSAGE bare through the raw sink instead of cli_activation_diagnostic(), so the reader got "Check the errors above" with nothing above. That is the exact dead end #1416 and #1537 already fixed: the property was repaired on the paths that had tests and left broken on this sibling, which had none.

The advice was wrong for the reported shape too. icacls <dir> /remove:g <sid> cannot remove an inherited ACE, and the stock C:\ grant for Authenticated Users reaches every new child directory exactly that way — so a reporter following our advice watches the command succeed and the refusal persist. The refusal now says whether the ACE was inherited, and names icacls <dir> /inheritance:r /grant:r "%USERNAME%":(OI)(CI)F for that case.

No safety check is relaxed. An install directory writable by other accounts is still refused — it is now refused in terms the reader can act on.

On the tolerance that was considered and rejected

#1856 also asks us to accept the stock Authenticated Users ACE so that installs under C:\ succeed. A design review rejected that, and the source backs it up:

• install.ps1 copies itself into the install directory with inherited ACLs, and cbm update tells the user to run that exact file.
• cbm install persists the install directory into HKCU\Environment\Path.
• The application directory is first in the DLL search order.

The binary's own DACL is owner-only and SE_DACL_PROTECTED, so the binary is safe — but the tolerance would have been on the directory, handing any authenticated local account a planted DLL beside the .exe, an editable install.ps1, and PATH shadowing. Refusing with an actionable message is the better trade, and it is what this PR does.

A separate, real asymmetry stays open for its own change: Windows ancestors are never DACL-checked in activation_transaction.c, while POSIX ancestors and the daemon's ancestors both are.

Tests

Both halves are RED-proven before the fix:

• tests/test_windows_bundle_contract.sh — four assertions fail on the previous installer (unconditional bit, missing build gate, missing enum probe, literal bitmask).
• tests/test_activation_diagnostic_contract.sh (new, wired into scripts/test.sh as Step 0e2) — fails naming src/cli/cli.c:750, plus the missing inherited-ACE report and missing /inheritance:r remedy. It guards the class: any emitter of a refusal constant that bypasses the attributing helper fails it, which is what would have caught the original miss.

Local: cli 314 passed · activation_transaction daemon_ipc daemon_bootstrap daemon_version 110 passed, 1 skipped (user namespaces are Linux-only; runs on the Linux leg) · make -f Makefile.cbm lint-ci clean.

Thanks to @zaferavci1 — the ProcMon trace, the decoded S-1-5-11, and the TLS bisect are why both of these are fixable at all.

Refs #1856