## Why
Private desktops need to remain available across command-runner exits and idle
gaps.
## What changed
- Keep parent-owned private desktops alive and reuse them only when the sandbox
account and effective permissions match.
- Pass the selected desktop name to elevated command runners, which validate and
open the existing desktop instead of creating their own.
- Apply the same policy-aware reuse to the legacy Windows sandbox path.
## Testing
Add Windows tests for desktop-name validation, lifetime and concurrent reuse,
and separation when effective permissions differ.
GitOrigin-RevId: 2df8b1c31ff22d72549f2ec3065cd80ea1dd0c6a
## Why
Elevated Windows sandboxes need stable managed-proxy ports while preserving the network policy and environment attribution of each sandboxed process.
## What changed
- Keep shared HTTP and SOCKS5 loopback ingress listeners alive across managed-proxy instances.
- Add a per-route restricting SID to elevated sandbox tokens and dispatch incoming connections to the matching proxy policy after attributing the client process.
- Reject connections without exactly one registered route, remove routes when their proxy handle is dropped, and keep unsandboxed Windows launches off the managed ingress.
- Provision the elevated sandbox with the configured proxy ports and local-binding setting, honoring the selected profile and CLI overrides.
## Testing
- Add Windows unit tests for TCP ownership attribution, route selection, restricting-token propagation, and setup settings.
- Add an end-to-end Windows test covering stable ports, isolated environment policies, HTTP and SOCKS5 routing, and route teardown.
GitOrigin-RevId: 783fac6e0f904dc9bb1955b75d4a5895e8bb9690
