Rate of Closure: harden Windows authority state

[d-sorgcodexagent]

Outcome

Implements the Windows authority-state ACL and reparse hardening tracked by #4385 as an exact child of PR #4391.

Security contract

• Fixed local NTFS only, with persistent ACL and named-stream support.
• Protected DACL with exact current-user, SYSTEM, and Builtin Administrators full-control ACEs on the root and DB/WAL/SHM/journal/lock artifacts.
• Retained non-delete-sharing handles bind ancestor, volume, file identity, reparse, hard-link, and ADS checks.
• Broad DACLs migrate in place with exact reverse-order rollback; owner mismatch fails closed.
• Dangling sidecar reparses, unexpected entries, ADS, hard links, substitutions, invalid paths, and unsupported volumes fail with sanitized typed codes.
• Clean-wheel seed/recover processes prove completed-result recovery and interrupted-job no-replay.

Local evidence

• 86 focused native/store/API/loopback/companion/workflow tests passed; four local symlink-privilege skips become mandatory failures in protected CI, plus one expected POSIX-mode skip.
• Ruff, format, YAML lint, focused MyPy, and campaign manifest validation pass.
• Python 3.11 and 3.12 clean-wheel installs pass exact ACL, schema v1, result recovery, no-replay, installed-module isolation, and zero Unicode-CWD pollution.
• Full Rate of Closure suite: 1,344 passed / 7 expected skips; one parallel timeout passed serially, and the remaining tooltip failure reproduces unchanged on parent test(rate): qualify production browser surfaces #4391.

Release blocker

This PR intentionally targets only [self-hosted, Windows, X64, d-sorg-windows-security]. No registered runner currently carries that restricted label. The protected native matrix must remain queued until such a runner is provisioned; do not route it to the persistent ControlTower/MATLAB runner or weaken the contract.

Human review is approved. Parent order, fresh protected CI, and ordinary non-admin merge behavior remain mandatory.