fix Windows controller startup reliability

[xipfs]

What changed

• Fix the Windows ACL fallback so icacls no longer receives a bare SID through /setowner, which fails with Windows error 1332.
• Perform the first renderer injection synchronously in the foreground before spawning the detached ephemeral controller.
• Verify an already-private Windows state root without rewriting its ACL on every lock acquisition; migrate only when verification fails.
• Add regression coverage for ACL fallback syntax, foreground-first injection, failed foreground injection, legacy ACL migration, and the private-root fast path.

Root causes

Three related Windows races were observed on the Microsoft Store build:

1. Set-Acl can fail in a limited session. The fallback passed a bare SID to icacls /setowner, which Windows interpreted as an account name and rejected with error 1332. This surfaced as LOCK_PERMISSIONS.
2. Initial skin application depended entirely on a detached ephemeral controller. During Store activation and process-tree replacement, that controller could start late or exit with the old process, leaving the foreground command polling to 160/160 without an applied skin.
3. Every state-lock acquisition rewrote the state-root ACL even when it was already exact and private. Concurrent ephemeral/background controllers repeatedly contended on ACL and lock operations, delaying controller:start beyond the background ACK window and triggering compensation back to disabled.

Impact

Windows Store users can apply a skin and enable persistent background control without the observed LOCK_PERMISSIONS, repeated 160/160 confirmation failures, or background-confirmation timeout caused by unnecessary ACL churn.

Validation

• Windows ACL adapter tests: 11/11 passed.
• Targeted Windows operation-lock migration/private-root tests: 2/2 passed.
• Foreground injection and confirmation regression tests: 3/3 passed.
• CLI suite: 93 passed, 1 skipped; one unrelated symlink test could not run because this Windows session lacks symlink creation privilege (EPERM).
• Live Windows Store verification: state and renderer reached persistenceEnabled: true, revision 6; transition journal cleared; scheduled task remained Running; exactly one background controller remained after handoff.
• git diff --check passed.