[desktop][security][win32] Bring AgentSidecar containment to GRIDA-SEC-004 parity

[softmarshmallow]

Context

Split from #974 after #983 separated Grida-owned provider networking from AgentSidecar egress on macOS and Linux.

Windows currently starts AgentSidecar without the kernel containment claimed by GRIDA-SEC-004. Shell and external ACP are withheld, but structured local filesystem capabilities remain available, and the package-level empty-destination policy is not a Windows network fence.

Problem

A fail-closed UI gate is not a platform sandbox. If AgentSidecar is compromised on Windows today, it retains the ambient filesystem, process, and network authority of the desktop process. That makes Windows a separate platform-containment deliverable, not a footnote on the provider-networking issue.

Required outcome

• Provide a supported, packaged Windows confinement boundary using AppContainer/Job objects, srt's proven Windows backend, or an equivalent design with evidence.
• Enforce filesystem and process isolation for AgentSidecar and every enabled raw runtime.
• Prevent generic bind/connect and direct provider/Gateway egress from AgentSidecar; Electron main continues to own the exact loopback listener and host-routed provider transport.
• Precisely bound structured local filesystem capabilities to host-issued workspace grants; unsupported capabilities are visibly withheld rather than ambient.
• Keep run_command, external ACP, and MCP/plugin runtimes withheld unless their required worker boundary is successfully provisioned and attested.
• Make containment state a native fact consumed by feature gates, not a renderer-controlled or boolean-only assertion.
• Supervise startup, crash, cancellation, update, and shutdown so process trees and grants cannot escape or outlive the app.
• Preserve BYOK/GG credential custody and the GRIDA-SEC-006 boundary.
• A provisioning or policy failure fails closed with a specific diagnostic.

Acceptance evidence

• packaged Windows tests demonstrate that AgentSidecar cannot read HOME secrets or non-granted paths, write outside granted roots, spawn an escaping process, bind/listen, or connect directly;
• provider/GG requests still succeed through the Electron-owned Chromium/system route;
• tests cover process-tree cleanup, policy/provisioning failure, updates, and feature withholding;
• GRIDA-SEC-004, release checks, and Desktop authority docs no longer describe Windows as unwrapped/nonconforming.

Dependencies and related work

• completed provider/GG network separation: [desktop][agent] Route provider and Grida Gateway traffic through the user's system network without granting agent egress #974 / fix(desktop): respect system networking for agent providers #983;
• one-shot shell worker: [desktop][agent] Run run_command in a supervisor-owned confined worker #985;
• external ACP: [desktop][agent] ACP provider support — drive Claude/Codex on the user's own subscription (Grida as ACP consumer) #813 / Productionize agent-provider transport: drop runtime npx, resolve the user's claude, verify packaged sandbox (#813) #871;
• user-installed MCP/plugin runtime: [desktop][agent] Isolate user-installed MCP/plugin runtimes with independent lifecycle and network grants #986.

This issue owns the Windows kernel/platform boundary. It does not merge the lifecycle contracts of shell, ACP, and extensions into one generic worker API.