feat(native): authenticated read-only consumer configuration (re-proposes #501 code) - #619

…oses #501 code)

Re-proposes the ~4k lines of code from #501 on current main, without the
~170k lines of evidence blobs that closed it.

The engine gains one versioned, read-only GetNativeConfiguration snapshot
for the authenticated native transport: image admission, defaults, bundle
metadata and physically identified storage choices. Storage observations
bracket the metadata read and recheck GPT disk/partition GUIDs, protection
state and the full NTFS serial; the system PowerShell and its modules load
from protected canonical paths, not inherited PATH or module search. The
original three-read assessment constructor stays restricted, and the new
constructor refuses mutators before backend work.

The shell decodes the snapshot (refusing incomplete, duplicate,
foreign-brand and false-authority observations) and shows a configuration
form under the branded card. The form clears private fields on disconnect
or a failed read. Install stays disabled.

Changes from #501 beyond the rebase: MainWindow.xaml keeps main's branded
card and adds the form inside it under a ScrollViewer;
native-configuration.yml uses the repo's SHA-pinned actions, a concurrency
group, and the Go module cache. shell/.gitignore keeps dotnet bin/ and
obj/ output out of commits.

Refs #344, #501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F5v5GG4NYnpzMrfPCo3vWN

Picks up #618 (winui-preview restructure). The configuration flush
control step stays in native-build; no Windows job is added.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F5v5GG4NYnpzMrfPCo3vWN

Both branded installed-package runs on #619/#620 failed the first
GetNativeConfiguration with the engine's own deadline diagnostic at
about 10.9 s (storage-first-query, Context:deadline, Exit:1):
run 38801276457 (wootc) stopped in the script's last phase,
"serialize"; run 38801326196 (tunaos) stopped before its first phase.
The packaging job runs its steps in PowerShell 7, so the engine's
storage query is the first Windows PowerShell 5.1 start on that runner,
and the cold start plus module and CIM loads exceeds the 10 s budget.
The native-configuration job passes because its own steps already run
Windows PowerShell 5.1.

The budgets are now named and nested: storage query 30 s < whole
configuration read 40 s < shell wait 50 s < the 60 s bound both
diagnostic decoders enforce. A slow read therefore still ends with the
engine's typed diagnostic. A Go test checks the order and reads the
shell's wait from NativeEngineSession.cs; a mutant with a 35 s shell
wait fails it. The installed UI test waits 60 s for the view.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F5v5GG4NYnpzMrfPCo3vWN

native-configuration controls failed on 23e827e after the budget fix.
TestNativeConfigurationActualPreparedStorageSnapshots kept its own 10 s
context; it makes the first real storage query in the test binary, so it
meets the same Windows PowerShell cold start as the product. It now uses
nativeStorageQueryBudget.

The control script now prints the failing or missing control names and
the go test return code in the job log, so a failure is readable without
the artifact. The budget-nesting test joins the required set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F5v5GG4NYnpzMrfPCo3vWN

With failing control names now in the log, run 38808993687 shows the
remaining native-configuration failure is
TestNativeConfigurationPreparedStorageTransportRefusals/held-stderr.
The fixture started a descendant powershell.exe and slept 1.5 s, then
the test required the descendant's "owned-descendant-started" marker in
the held stderr pipe. A slower descendant start loses that race without
any product fault. The case uses its own 5 s context, so the budget
change in this PR does not touch it.

The descendant now writes its stderr marker and then a readiness line on
its redirected stdout; the helper reads that line before it answers. The
marker is therefore in the pipe before the first query returns. The
five-second observation deadline and every assertion are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F5v5GG4NYnpzMrfPCo3vWN

held-stderr failed on 65b9966 (fixed sleep) and 4b50d6d (readiness
handshake). Root cause: the fixture helper starts its descendant with
.NET Process.Start, UseShellExecute=false and only stdout redirected.
.NET then gives the descendant the helper's own stdin, which is the
session request pipe, and Windows PowerShell reads redirected stdin as
$input until EOF. The descendant therefore competes with the helper for
the test's "nonce|N" request lines. When it takes one, the helper never
answers, the query dies at the 5 s context, and the stderr marker races
the job cleanup. The earlier pass was a lucky ordering; the readiness
handshake made the theft certain, because the descendant was always
running before the helper read its first request.

The descendant now gets a private stdin that the helper closes at once,
so its read ends at EOF and it inherits only the stderr pipe this case
is about. The readiness line then orders the stderr marker before the
first answer. The five-second observation deadline and all assertions
are unchanged.

The control script now also prints the failing tests' own
file:line messages (at most 40 lines), because the artifact host is not
reachable from every reviewer environment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F5v5GG4NYnpzMrfPCo3vWN

…sion

held-stderr on cbdcb2f printed its reason (job 116687773615):
"native_storage_session_windows_test.go:122: bounded fixture compilation
failed storage observation command refused". Line 122 calls
prepareNativeHeldStderrAssembly, which compiled the P/Invoke fixture by
replacing nativeStorageQuery with an Add-Type script and running it
through the production storage session. That session refuses anything
off its contract with one fixed error class, so a slow or failed cold
Add-Type/csc compile could only show as a refusal, with the reason left
in the artifact.

The fixture assembly is scaffolding, not code under test. It is now
compiled by a plain exec.CommandContext of the system Windows
PowerShell, under its own 60 s bound, and a failure logs the elapsed
time, the error and up to 4 KiB of the compiler output. Only the timed
held-stderr observation still runs through the guarded session, with the
same exact assembly bytes (hash checked), the same five-second deadline
and the same assertions.

The control script's go test bound rises from 90 s to 150 s (subprocess
240 s), because the run now holds a 60 s fixture bound and 30 s storage
budgets; the job limit stays 10 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F5v5GG4NYnpzMrfPCo3vWN