feat(setup-owner): fence Windows setup trees

[BramVR]

Blender Box setup currently loses process ownership if its SSH launch is interrupted before PowerShell records a process identity. That makes safe cancellation and recovery impossible without broad process discovery.

This adds a private, fixed-purpose setup-owner contract backed by atomic suspended-process assignment to a kill-on-close Windows Job Object. Requests, receipts, and terminal records are create-once and fenced by Attempt ID, Launch ID, exact request SHA-256, and deadline. The bootstrap accepts only the staged script bytes declared by the request, verifies their size/SHA-256/strict UTF-8 encoding, and never exposes a generic command runner. Status and stop recover conservatively and report cleanup_unverified whenever exact tree disappearance cannot be proven.

Proof:

• uv run ruff check .
• uv run pytest -m "not e2e" -q — 152 passed, 1 Windows-only skip
• uv run pytest -m "e2e and not real_blender" -q — 18 passed
• Authorized owned-host proof from a wheel built from this branch: runtime capability self-test with SystemRoot deliberately poisoned, byte-identical replay, stale-stop rejection, exact root/child teardown, unrelated decoy survival, stable repeated stop, owner-loss reconciliation, and clean completion all passed
• Autoreview: clean after all accepted findings were fixed

Supports BramVR/blender-box#12 without closing it.

Model: GPT-5.6 Sol (high). Harness: Codex desktop, pytest/ruff, autoreview, and opt-in Windows SSH proof.

[Copilot]

🔵 Needs a closer look

It introduces new low-level Windows Job Object/process-control code and a new fenced persistence protocol, which warrants careful human review on real Windows environments.

Pull request overview

Adds a Windows-only, identity-fenced “setup-owner” protocol so Blender Box can reliably own/cancel/recover a setup process tree even if SSH launch is interrupted before the client can record a PID.

Changes:

• Introduces setup_owner state machine and record formats (request / receipt / terminal) with strict fencing and create-once persistence.
• Implements a Windows keeper (windows_setup_process) that creates a kill-on-close Job Object, starts PowerShell suspended with atomic job assignment, verifies script bytes (size/SHA-256/strict UTF‑8), then resumes.
• Extends the CLI and docs with a runtime-gated windows-setup-owner-v1 capability probe and setup-owner command, plus comprehensive tests.

File summaries

File	Description
tests/test_windows_setup_process.py	Validates suspended creation, job assignment, bootstrap behavior, and keeper edge cases.
tests/test_setup_owner.py	Exercises request fencing, replay, stop/status recovery, and record invariants.
tests/test_cli.py	Adds CLI coverage for setup-owner routing and capability gating.
src/blendersessiond/windows_setup_process.py	Implements Windows Job Object “keeper” and suspended PowerShell bootstrap/IO handling.
src/blendersessiond/setup_owner.py	Implements fenced request/receipt/terminal protocol and persistence for setup attempts.
src/blendersessiond/cli.py	Adds setup-owner command and runtime-gated capability reporting.
README.md	Documents the new setup-owner command and capability probe.
docs/adr/0005-fenced-windows-setup-owner.md	ADR describing the setup-owner design and invariants.
CHANGELOG.md	Notes the addition of the Windows-only setup-owner protocol and capability probe.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BramVR]

Independent merge gate passed on 6acdf88603838105c239fb1b7d279738040754e3.

• Terra 5.6 high re-reviewed the complete PR and verified the GetSystemDirectoryW fix prevents inherited SystemRoot from redirecting PowerShell.
• Local proof: Ruff passed; 152 non-E2E tests passed with 1 Windows-only skip; 18 fake-boundary E2E tests passed.
• Exact Windows proof passed with SystemRoot deliberately poisoned, including capability, replay, cancellation, process-tree cleanup, owner-loss recovery, and clean completion.
• All GitHub CI, Windows, required real-Blender, macOS, and build checks passed on the exact head.
• No accepted or actionable review findings remain.