Make Windows fence tests portable and recognize equivalent trustee identities

[CompleteDotTech]

Use owned temporary Windows fence fixtures with verified protected ACLs before pinning them. Hosted traces confirmed that deny operations on inherited, unprotected ACLs created explicit allow copies; the production strict guard is unchanged. Diagnostics distinguish first-read failures and report probe-directory removal failures as unsuccessful cleanup. The fixture regression now expects both rejection codes for an Everyone read grant.

Refs #108, #90. Related #110.

Validation: Windows 3.12/3.13 passed original 9, trustee 14, strict 10 and diagnostics 18 on the previous head. The remaining fixture assertion is corrected with a portable regression. Fresh final-head Windows gates require all 64 cases to pass without skips: 9 + 14 + 13 + 10 + 18. Linux fixture validation executed 9 tests with 4 native cases NOT_RUN on both interpreters; three mutations were detected. Final-head CI and independent Astra review are pending.

Source archive: 709 manifest entries, 710 members; SHA-256 34a733f411ada1c88419b5321d05f1a49a75b30333f932f09ebd0ff29f367a4c. Existing source suffix policy excludes tracked render.mjs. Historical empirical and private pilot acceptance remain separate and open.

[CompleteDotTech]

Independent Astra review: APPROVE for head d5e101ff470b44cf851c1ffa485fb2dab3d7b65c, base 04acabedcfff1cef9871087fd6a6374375ab5ebf. Actual model gpt-6-astra, reviewer session 01a1190e-8968-7163-b4fd-d073c1423d6c; runtime attribution verified by orchestrator. This is an attributed agent review, not a submitted GitHub approval.

All ten jobs in final-head push run 37711375143 and PR run 37711380227 passed. Native Windows Python 3.12/3.13 each passed 64 cases without skips; strict guard and original security assertions preserved, protected disposable fixture readbacks and cleanup verified. PR merge tree equals the signed head tree. Source package: 709 manifest entries / 710 members, SHA-256 34a733f411ada1c88419b5321d05f1a49a75b30333f932f09ebd0ff29f367a4c; existing source suffix exclusion is qualified.

Live gate recheck, merge and post-merge verification follow. Historical pilot and empirical acceptance remain separate. Refs #108, #90; related #110.