Support Windows sandboxing in the exec server

[copyberry]

Support Windows sandboxing in the exec server

Why

Sandboxed process launch through the exec server was unsupported on Windows.

What changed

• Add a shared native process launcher that selects the Windows sandbox session backend when required and otherwise launches PTY or pipe-based processes.
• Pass Windows permission, workspace-root, proxy, filesystem-override, and desktop settings through exec-server process preparation.
• Preserve piped stdin and inherited file descriptors across the shared launch path.

Testing

• Verify that a remote Windows sandbox process accepts stdin while blocking a write under a read-only policy.
• Enable workspace-root sandbox tests on native Windows while continuing to skip environments that cannot emulate Windows sandbox semantics.