## Why
A runtime directory can have read/execute access while existing files and subdirectories lack inherited permissions. Checking only the runtime roots leaves those children inaccessible to sandbox users.
## What changed
- Walk the Codex app runtime tree and add missing read/execute grants for the sandbox group, validating access after changes.
- Use `GRANT_ACCESS` to preserve existing grants and skip additions that could override deny entries, including inherited denials for other trustees.
- Skip reparse points and trees with reparse-point ancestors, tolerate disappearing paths, and report repair failures through setup logging and refresh errors.
## Testing
Add Windows regression tests for repairing children beneath an already-readable root, repeated repairs, preserving read/write denials and other trustees' inherited file denials, avoiding write or ACL-management grants, and leaving junction targets untouched.
GitOrigin-RevId: 93d55dd9fca2b24eac157ae9be505982d07dd9b9
chess
2833985d88