## What changed
- Use the installed provisioning service regardless of the onboarding feature gate. Fall back to the elevated helper only when the service is unavailable; propagate service errors.
- Pass the effective proxy settings and filter listener ports to match them, including when preserving saved settings.
- Remove stale credentials before repairing missing, disabled, or password-expired sandbox accounts so older services cannot mistake them for completed setup.
- Select helper fallback when workload-identity environment variables are present, since service requests do not carry that environment. Continue rejecting helper fallback for registered Core.
## Testing
Extend account-repair tests to cover stale credential removal, missing and disabled accounts, and repeated setup checks. Add subprocess tests for workload-identity routing with and without registered Core.
GitOrigin-RevId: 1041ae76e9b0893ad60f30a5cdc506748be52552
32b54cffdd