Harden production runtime, installer, and release trust boundaries

[wiresock]

Merge method required

Use Create a merge commit. Do not squash or rebase this PR.

The reusable workflow callers intentionally pin immutable implementation commit 0440f3d3a42216a23ce455686ce983b88af62a3e. Squashing would omit that commit and rebasing would rewrite it, breaking reusable-workflow resolution, runner-group selection, trusted-tool checkout, and the documented OIDC identity.

After merge, verify the implementation commit is reachable before updating privileged infrastructure:

git fetch origin main
git merge-base --is-ancestor 0440f3d3a42216a23ce455686ce983b88af62a3e origin/main

During that maintenance window, keep SDK integration disabled/fail-closed and do not start a release. Change the wiresock-sdk runner group's sole selected workflow and the Azure federated credential's job_workflow_ref from the previous pin to 0440f3d3a42216a23ce455686ce983b88af62a3e, then re-enable privileged execution only after the hosted policy preflight passes.

Summary

• fix elevated-token role checks by requesting the duplication right required by WindowsPrincipal.IsInRole
• exercise native hosts from a recursively protected Program Files tree on the actual local fixed volume
• replace compatibility-lied VersionNT gating with an exact CurrentBuildNumber AppSearch contract
• restore the locked WiX toolchain in MSI smoke jobs and surface bounded verbose installer failure evidence
• keep the generated native sentinel portable across current x86, x64, and ARM64 Visual C++ toolsets
• centralize fail-closed MSI ACL-rights classification, including raw GENERIC_* masks, with SDDL regressions
• apply protected ACLs to every MSI-owned file and payload directory so force-all repair normalizes post-install ACL corruption
• validate machine-wide Start Menu and system install paths through native known-folder APIs, local fixed NTFS/reparse/owner/DACL checks, and child-inheritance-aware replacement analysis
• harden startup, shutdown, tunnel recovery, settings, filesystem, logging, and native-host failure paths
• make native and MSI outputs architecture/flavor-specific across x86, x64, and ARM64
• add an exact, headless native-host self-test contract with deterministic pre-CLR and managed failure codes
• fix x86 MSI .NET detection to use the documented 32-bit registry view and reject locator regressions
• make normal and no-build publish retries remove stale TargetDir launchers while retaining strict production subtree validation
• enforce signed release authorization, protected environments, immutable publication, provenance, SBOM, and exact package validation
• isolate privileged SDK runners behind immutable reusable workflows and hosted runner-policy checks
• lock all six production workflow definitions and all seven privileged pins to audited content, with adversarial regression fixtures

Validation

• managed harness: Classic Release x64 and Debug x64 — 198 passed, 0 failed, 1 environment-only symlink skip in each run
• managed harness: Release UWP x64 — 197 passed, 0 failed, 1 environment-only symlink skip
• native hosts: Debug and Release with /W4 /WX; static x86, x64, and ARM64 host validation; exact self-test/token contract checks
• publish: repeated Release publish and publish --no-build isolation regression; validated production x86 launcher
• installer: fresh six-MSI x86/x64/ARM64 × classic/UWP matrix, WiX ICE 0 warnings/0 errors, exact package validation, and adversarial architecture-isolation tests
• MSI ACL regressions: exact per-object table coverage, fresh-install and force-all repair assertions, transition checks, and PowerShell 7/5.1 ACL round trips
• workflow security, release SBOM (14/14), signing payload, release publication, SDK runner policy, repository policy, bounded MSI diagnostics, and launch-condition regression suites
• PowerShell AST, XML/workflow parsing, exact SHA/digest verification, dotnet format --verify-no-changes, and git diff --check
• three independent final review passes reported clean

Local limitations: Windows symlink creation was unavailable for one managed fixture. Live elevated native-host and install/repair/uninstall behavior remains covered by guarded CI runners. NuGet vulnerability metadata was unavailable from the local sandbox, while locked restores and CI audit enforcement remain configured.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.