[Bug][Windows] 工作区在用户配置目录之外时沙箱预授权 fail-closed（SetNamedSecurityInfoW Win32 5）

[C-yiqi]

Windows 上，如果工作区不在用户配置目录里（比如 D:\save），而且它的权限是从卷根继承来的——权限列表里没有当前用户本人，只通过 Authenticated Users 组拿到「修改」——一开会话就报：
SetNamedSecurityInfoW failed (Win32 5): grantWrite(D:\save)
因为是 fail-closed，这个会话里所有 shell 命令都跑不了，连 whoami 都不行，而报错里没有任何提示告诉用户该怎么办。
原因：沙箱要给工作区目录打一个 Low 完整性标签，标签存在 SACL 里，写它需要 WRITE_OWNER；而「所有者」身份只隐含 READ_CONTROL 和 WRITE_DAC，不含这一项，于是整次调用一起失败。
对照：同一台机器、同一版本、同一个模式，工作区放在 C:\Users\<用户>\ 下（用户有 Full Control）就一切正常，连开 3 个会话都没问题。手动补一条权限后授权阶段即通过（不需要提权）：
icacls "D:\save" /grant "<用户>:(OI)(CI)(WO)"
环境：0.2.0-rc.2 桌面版，Windows 11 10.0.26100，本地非管理员账户，workspace-write。

[argszero]

The diagnosis in your report is right, and it is the case the package documents as a boundary rather than as a bug — the workspace sits outside the user profile and inherits its access from the volume root ("Authenticated Users: Modify", 0x1301bf), which is explicitly named in the README's first section, items 1–3 (packages/sandbox/sandbox-windows-acl/README.md):

• the label lives in the SACL, so the merged SetNamedSecurityInfoW additionally needs WRITE_OWNER on the directory — an object right, which the owner's implicit READ_CONTROL/WRITE_DAC does not include, and which an inherited Modify ACE does not include either;
• it is not SeSecurityPrivilege, and elevation is the wrong lever: granting WRITE_OWNER needs none, which is exactly what your icacls "D:\save" /grant "<user>:(OI)(CI)(WO)" demonstrates. #7735 settles the gate with an isolation table on one machine and one unprivileged account: the apply succeeds with Full control or with Take-ownership alone and fails with ChangePermissions, ReadPermissions or Modify alone — WRITE_OWNER and nothing else;
• (WO) is WRITE_OWNER, so the line you used grants nothing the backend did not already require of the directory. It is also the right that only works when the caller owns the directory; where it does not ((Get-Acl "<dir>").Owner), the same line is refused for want of WRITE_DAC, and the grant has to come from an account that holds it, or by taking ownership first, or by moving the workspace under %USERPROFILE% — which is the control you ran.

For the shape failing closed at session start, so every command including whoami dies: @argszero/cordis-plugin-sandbox-grant-advisor 0.13.0 (published today) exists precisely for that signature. It recognizes SetNamedSecurityInfoW failed (Win32 N): grantWrite(<dir>) on the error path and attaches one user-role advisory per agent naming the missing right, the two environments the same text describes (an inherited Modify-only ACE, as here; a data volume where no ACE names the caller at all), the version boundary that arrived with the mandatory label (0.1.7-alpha.1, flag 20, versus the DACL-only flag 4 up to 0.1.6-alpha.x — so downgrading is not the remedy), the two remedies that look right and are not (takeown, icacls /reset), and the ownership check the remedy forks on. It never edits an ACL, never elevates, and blocks nothing unless you enable its optional enforceAfter.

- insert:
    - id: sandbox-grant-advisor
      name: '@argszero/cordis-plugin-sandbox-grant-advisor'