zm-oai 17cd2834e3 Repair rejected Windows sandbox credentials during provisioning (#47695) ...

## Why

Registered Windows sandbox setup could appear complete even when Windows rejected the stored account passwords. Checking account flags alone did not detect these failures before runtime logon.

## What changed

- Check stored credentials for both offline and online accounts before reusing completed setup during non-refresh provisioning.
- Classify logon failure, expired-password, and password-change-required errors as `SandboxAccountCredentialMismatch`, preserving the underlying Windows error.
- Trigger full setup to rotate credentials only after verifying that recorded account SIDs still match. Propagate credential-file and policy errors without triggering password repair, and skip credential checks for refresh-only requests.

## Testing

Add tests for native error classification, missing credential files, healthy credentials, password failures on either account, policy failures, and rejection of repair when account ownership validation fails.

GitOrigin-RevId: b3aa02f82841dd2605b0c3585ec93144727721e6

2026-09-23 23:33:19 +00:00

..

src

Repair rejected Windows sandbox credentials during provisioning (#47695)

2026-09-23 23:33:19 +00:00

BUILD.bazel

Add service-managed package registration for Windows sandbox accounts (#45542)

2026-09-14 23:24:10 +00:00

Cargo.toml

Complete Windows sandbox uninstall cleanup (#45799)

2026-09-15 21:33:16 +00:00