## Why
The Windows sandbox service had provisioning policy and client authentication in place, but its IPC listener was still disabled.
## What changed
- Serve framed provisioning requests over a local named pipe, authenticate packaged clients, validate requests and machine policy, and report provisioning outcomes through bounded responses and Windows event logging.
- Return `unavailable` for configuration parse failures so clients can fall back to the elevated setup helper.
- Keep validated directory handles alive in the setup helper so path protections survive an unexpected service exit.
- Make connection recovery and shutdown wakeups tolerate clients that disconnect before the listener accepts them.
## Testing
Added Windows tests for response framing, configuration-error classification, pipe security and reconnect behavior, shutdown wakeups, and retained helper handles.
GitOrigin-RevId: 68e9d546dcada88ff162ea4f98c0f4d748706b34
7e45bdb5fd