feat(windows): add MXC sandbox policy parity

[qedawkins]

Motivation

Windows support previously exposed nominal policy features without a tested process-isolation boundary comparable to Linux. Use Microsoft MXC for Windows process containment so AXIS can remain the consistent, platform-neutral policy layer instead of reimplementing the operating-system sandbox.

This change targets Linux policy parity for Windows. GPU/AMD policy remains out of scope because that surface is not yet implemented on Linux either.

Technical Details

• Select MXC for the Windows auto and mxc process backends, and reject the legacy axis_native host-spawn path so sandbox requests fail closed.
• Translate filesystem, process, timeout, identity, child-process, resource, network, inference, and scoped-SSH policy into validated Windows containment.
• Prefer BaseContainer on supported Windows builds. Keep the AppContainer/DACL compatibility tier behind explicit AXIS_MXC_ALLOW_DACL_MUTATION=1 consent.
• Add Job Object lifetime and resource enforcement, WFP strict-proxy brokering, managed home/state projection, ConPTY support for the DACL tier, host-side inference credential handling, token-budget enforcement, and scoped SSH proxying.
• Pin MXC and carry three reviewed patches for explicit fallback selection, Job assignment, and strict WFP proxy integration. Package the required Windows executables and setup helpers in CI and release artifacts.
• Document Windows setup, runtime dependencies, capability tiers, isolation guarantees, and fail-closed limitations. BaseContainer ConPTY remains capability-gated because Windows build 26300.8772 rejects pseudoconsole startup handles with ERROR_INVALID_HANDLE.

Test Plan

• The Windows MXC adapter and policy unit tests verify fail-closed backend selection, BaseContainer-by-default behavior, explicit DACL-tier consent, secret-free executor state, command quoting, wire serialization, cleanup, and rejection of unsupported policy combinations. Filesystem cases cover case-insensitive overlap, junction aliases, alternate data streams, and device namespace paths.
• test_mxc_processcontainer.ps1 exercises the common policy boundary through both MXC isolation tiers. It checks missing-executor failure without host fallback, command execution, secret environment filtering, managed-profile projection, read-only/read-write/default-deny filesystem behavior, and paired network block/allow behavior. Its BaseContainer cases additionally verify arbitrary granted executables, process-count and child-denial limits, aggregate memory, CPU rate limiting, timeout descendant cleanup, and absence of host ACL mutation.
• test_mxc_strict_proxy.ps1 exercises the elevated WFP broker as an adversarial network boundary. It permits only the configured HTTPS proxy path, rejects a disallowed proxy destination, blocks direct TCP, DNS, QUIC/UDP, and IPv6 bypasses, correlates audit events, isolates concurrent leases, and verifies fail-closed process termination and stale-lease recovery across broker loss.
• test_mxc_conpty.ps1 verifies interactive terminal behavior on the supported AppContainer/DACL tier, including console detection, size, ANSI output, prompt/input/echo, exit propagation, and ACL restoration. It also verifies that BaseContainer rejects ConPTY before launching MXC on affected Windows builds.
• test_mxc_inference.ps1 sends a real BaseContainer client through the strict proxy to a mock provider. It verifies streaming, host-side credential injection, absence of provider secrets in the guest and its output, and rejection of over-budget requests before they reach the provider.
• test_mxc_scoped_ssh.ps1 verifies managed-home projection of generated SSH key, config, known-host, and helper files; denial of the original host key; byte relay to an allowed destination; and rejection of an unlisted destination.
• Unit and integration coverage for the WFP protocol, proxy credentials and token budgets, managed-home preparation, and SSH projection exercises invalid inputs and cleanup paths that are unsafe or impractical to induce in E2E. Workflow structure tests ensure Windows CI builds the pinned patched executor, runs the BaseContainer smoke test, and publishes every required helper.

Submission Checklist

• Reviewed the ROCm contribution guidelines.
• Confirmed the code builds successfully.
• Confirmed existing tests pass and added coverage for the new functionality.
• Added or updated documentation for the new Windows policy behavior.
• Kept unsupported policy surfaces fail-closed and documented limitations.