## Why
Some Windows policies deny in-process reparse-point mutation while allowing the system junction creator, preventing managed daemon release selection.
## What changed
Fall back to `cmd.exe` with `mklink /J` when native junction creation or retargeting returns `PermissionDenied`. Pass quoted paths through environment variables and disable delayed expansion to handle shell metacharacters.
Create the replacement junction before moving the existing `current` junction aside, and attempt to restore the previous junction if installation fails. Preserve it for recovery if restoration also fails.
## Testing
Extend the Windows junction test to cover fallback creation, native retargeting, and fallback replacement under a path containing spaces, `&`, `%`, and `!`, while verifying that no standalone CLI installation is created.
GitOrigin-RevId: 039ee850f8c788f44f08116614ca3927e3e9952f
Eric Traut
b989f795b1