fix(install): trust the local machine's built-in Administrator; name untrusted owners (#1705, #2023, #1686)

[DeusData]

Problem

On Windows, an install/daemon runtime directory created by an elevated process is owned by the built-in Administrator account (RID 500 under the local machine account-domain SID) — even when that account is renamed or disabled. cbm's directory-owner/ACL trust refused it, so install/activation failed on those machines (#1705). Separately, an owner-trust refusal reported only a terse status -3, os 0, giving the operator nothing to act on (#2023, #1686).

Fix

#1705 — resolve this machine's built-in Administrator SID and trust it as a directory owner/grantee:
LsaOpenPolicy(POLICY_VIEW_LOCAL_INFORMATION) + LsaQueryInformationPolicy(PolicyAccountDomainInformation) → CreateWellKnownSid(WinAccountAdministratorSid, accountDomainSid), cached once per process (fail-closed on any LSA/synthesis failure). Wired into the daemon's win_sid_trusted and the CLI activation transaction's owner + ACE trust. owner-not-current-user (the exact-owner target rule) is left unchanged.

It is deliberately not IsWellKnownSid(WinAccountAdministratorSid) and not a trailing-RID-500 match — both would accept a foreign S-1-5-21-*-500 (a domain admin, or another machine's Administrator), a cross-machine trust escalation. PolicyAccountDomainInformation is the local SAM domain (not PolicyPrimaryDomainInformation = the AD domain), so on a domain-joined workstation a domain admin's -500 is foreign and rejected.

#2023 / #1686 — an owner-trust refusal now appends the offending owner's SID string to the note (the path was already carried).

Scope notes (by design)

• Domain controller: a DC has no separate local SAM, so its account domain is the AD domain — there, this trusts the domain Administrator. On a DC that account is the machine-equivalent top admin, so this is consistent with the intent.
• Cloned images: an un-sysprepped Windows clone shares the machine account-domain SID, so a sibling clone's built-in Administrator would be non-foreign. Inherent to any machine-SID-based identity.

Verification (native Windows arm64 VM)

• Compiles under the sanitized build (ntsecapi.h/LSA types resolve).
• daemon_ipc SID-trust test: 35 passed / 0 failed with the fix — local RID-500 trusted, a fabricated foreign S-1-5-21-111-222-333-500 rejected, BUILTIN\Administrators trusted.
• RED-on-revert: reverting the trust clause → 34 passed / 1 failed (ASSERT(local_ok) at test_daemon_ipc.c:1032) — exactly the SID-trust test flips.
• Windows ancestor-ACL guards pass (Windows: activation ancestor-walk fails unconditionally on stock/default ACLs (no OS-level denial in ProcMon trace) #1856: stock ACEs already tolerated, no change).

Adversarially reviewed as a security-boundary change: the foreign--500 bypass does not materialize on a domain-joined machine (local SAM domain), the resolution is fail-closed, and the foreign--500 rejection is confirmed by an independently-derived test SID.