Downlevel Phase 5 - integration

[MGudgin]

This PR integrates the downlevel work done in previous phases such that the
feature works end-to-end. Currently only T3 is supported downlevel. There is a
compile-time tier2_bfs feature that keeps T2 unreachable in production
builds on hosts where bfscfg.exe hangs the OS (Windows 11 25H2).
Crash-safe host-DACL augmentation backs T3.

Details:

• New tier2_bfs Cargo feature; off by default; gates both probe-time
  discovery and runtime spawn of bfscfg.exe.
• DaclManager with per-process state files under
  %LOCALAPPDATA%\Microsoft\MXC\dacl-restore, surgical canonical-order
  DACL rewrite, and orphan reaping on next wxc-exec --probe.
• wxc-exec --probe exposes tier decision + warnings; SDK
  getPlatformSupport() surfaces them as isolationTier /
  isolationWarnings.
• New wxc_ui_probe binary for in-sandbox JOB_OBJECT_UILIMIT and
  Win32k-mitigation telemetry.

Test:

• Win25H2Safe-Tests.ps1 harness: 78/81 (3 known UI-policy gaps).
• T3-Workloads.ps1 smoke suite: 7/10 (3 known AC NUL-device denials).
• wxc_common cargo test: 388/388 feature-off, 396/396 feature-on.
• SDK npm test: 151 pass.
• CI matrix now exercises --features tier2_bfs on x64 + arm64.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

This PR completes “downlevel phase 5” end-to-end integration by (1) compile-time gating Tier 2 BFS (bfscfg.exe) behind a tier2_bfs feature, (2) adding a read-only wxc-exec --probe JSON surface that the TypeScript SDK consumes via getPlatformSupport(), and (3) hardening Tier 3 (AppContainer + DACL) behavior via crash-safe DACL state management and new validation harnesses.

Changes:

• Add wxc-exec --probe + wxc_common::probe and wire it into the SDK’s getPlatformSupport() as isolationTier / isolationWarnings.
• Introduce tier2_bfs feature gating for BFS discovery + invocation, plus related dispatcher/detector logic updates.
• Add wxc-ui-probe (in-sandbox UI restriction telemetry) and new PowerShell harness scripts; update CI to test --features tier2_bfs.

Show a summary per file

File	Description
test_scripts/Win25H2Safe-Tests.ps1	New safety-focused harness validating Tier 3 + DACL recovery behavior on 25H2 without invoking bfscfg.exe.
test_scripts/T3-Workloads.ps1	New workload-oriented script exploring what can run under Tier 3 (AppContainer + DACL) on 25H2.
src/wxc/src/main.rs	Adds --probe and introduces Ctrl-handler-driven DACL cleanup via a global parked DaclManager.
src/wxc/Cargo.toml	Forwards the tier2_bfs feature to wxc_common.
src/wxc_ui_probe/src/main.rs	New Windows UI-mitigation probe binary (JOB_OBJECT_UILIMIT + Win32k mitigation).
src/wxc_ui_probe/Cargo.toml	Declares the wxc-ui-probe binary crate.
src/wxc_common/src/test_env.rs	Feature-gates MXC_BFSCFG_PATH test seam guard behind tier2_bfs.
src/wxc_common/src/probe.rs	New serde-friendly probe surface (ProbeOutput) used by wxc-exec --probe.
src/wxc_common/src/lib.rs	Exposes the new probe module on Windows.
src/wxc_common/src/filesystem_dacl.rs	Improves DACL state-file robustness, adds canonical DACL rebuild path + effective-access computation + tests.
src/wxc_common/src/filesystem_bfs.rs	Adds defense-in-depth gating so bfscfg.exe cannot be invoked without tier2_bfs.
src/wxc_common/src/fallback_detector.rs	Adds tier2_bfs gating for bfscfg discovery and refines WRITE_DAC checks via effective-access inspection.
src/wxc_common/src/dispatcher.rs	Makes Dispatched extraction safer (private fields + into_runner_and_guard), adds grant-filtering, improves DACL error shape.
src/wxc_common/Cargo.toml	Introduces the tier2_bfs feature (off by default).
src/Cargo.toml	Adds wxc_ui_probe to the Rust workspace members.
src/Cargo.lock	Adds wxc_ui_probe package entry.
sdk/tests/unit/platform.test.ts	New unit tests for getPlatformSupport() probe integration + findWxcExecutable() failure modes.
sdk/src/types.ts	Adds IsolationTier type and extends PlatformSupport with isolation fields.
sdk/src/platform.ts	Adds cached getPlatformSupport() and a wxc-exec --probe integration path with test injection seam.
sdk/src/index.ts	Re-exports IsolationTier.
sdk/package.json	Includes the new platform.test.js in the unit test suite.
.gitignore	Ignores .copilot/ and .claude/ directories.
.github/workflows/build.yml	Adds CI coverage for cargo test -p wxc_common --features tier2_bfs.

Copilot's findings

• Files reviewed: 21/23 changed files
• Comments generated: 4