zm-oai 52950c5924 Validate Windows sandbox accounts before password repair (#52682) ...

## Why

A credential mismatch can trigger setup that rotates both sandbox account passwords. Before allowing repair, validate the account that logged on successfully and ensure that neither account has been replaced or has an unowned runtime registration.

## What changed

- Validate runtime records and successful logon tokens, checking account SIDs, rejecting administrators, and requiring enabled `CodexSandboxUsers` membership.
- Before repair, verify recorded account SIDs and reject existing same-family package registrations for unrecorded accounts. Propagate package-query failures while allowing initial migration when no registrations exist.

## Testing

Add tests for malformed records and unrelated logon errors, plus an ignored disposable Windows Sandbox fixture covering successful logons, group membership, SID changes, migration, and unowned registrations.

GitOrigin-RevId: bafedb52cf9bd484250ccac3b163d2041891283f

2026-10-09 19:48:39 +00:00

..

src

Validate Windows sandbox accounts before password repair (#52682)

2026-10-09 19:48:39 +00:00

BUILD.bazel

Add Bazel release staging archives (#51850)

2026-10-07 22:11:14 +00:00

Cargo.toml

Upgrade Windows bindings to windows-sys 0.61.2 (#50058)

2026-10-01 18:05:05 +00:00