## Why
Cleanup needs fresh logon tokens for sandbox accounts that may already be disabled. Temporarily enabling those accounts must leave a durable obligation to disable them again if the service exits unexpectedly.
## What changed
- Persist `cleanup_logon_pending` before enabling an account, then disable it again after the logon attempt before clearing the marker.
- Recover pending account disables before owner restoration or IPC admission, validating account SIDs before restoration. Block runtime readiness and provisioning while recovery is pending, and defer retirement until cleanup logons are prepared.
- Include the blocking logon details in cleanup timeout errors and suppress repeated identical cleanup errors in the Windows event log.
## Testing
Add receipt tests covering backward-compatible defaults and pending cleanup state surviving serialization, blocking readiness and owner admission until cleared.
GitOrigin-RevId: 801bec408a27ac85ccdc3eb5ca2bdb2ccb3d5827
fd875b188b