#3399 [Other] preserve Windows child identity after adopting user defaults

本文

## Problem and result

On Windows, `serve.server.main()` calls `adopt_user_defaults()` before starting children. Its token-default DACL grants `FA` (`FILE_ALL_ACCESS`), but that default also applies to new process objects. The file access mask omits `PROCESS_QUERY_LIMITED_INFORMATION`, so a live child can become unreadable to `procs.start_token()` and its ownership record cannot be written.

This surfaced as two lifecycle failures after an earlier test entered `main()`. The same lifecycle tests passed alone. A new isolated regression reproduces the actual cause: adopt the defaults, start a real sleeping child, and try to identify and record it.

Use `GA` in the **token default** so Windows maps the access mask for each newly created object type. The existing principals—current user, SYSTEM and Administrators—are unchanged. File-specific ACL code still uses file rights.

## Related discussion

Discovered while checking the current release for #1493, but this fix is independent of adaptive inference and changes no model behavior. I searched open and closed items for `default DACL`, `adopt_user_defaults`, and child/access-denied reports before opening this.

## Approach

One access-mask correction plus a Windows-only regression in a disposable interpreter. The test does not change the test runner's token defaults and always stops its own child.

References used for the correction:
- [Microsoft: process security and access rights](https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights): default process ACLs come from the creator's token; limited process queries require `0x1000`.
- [Microsoft: ACE strings](https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings): `FA` is file-all access; `GA` is generic-all access.

## Validation

Windows 11, Python 3.11. Base `c093ac263f8175307e67b7fd7eeeaa2e73ceaded`; fixed revision `841476cdcc566dcdcf750121ef235749efc06375`.

**Passed:**
- New regression on the fixed revision: live child identified and recorded.
- Combined new regression, `tests/terminal/test_private_files.py`, `tests/terminal/test_procs.py`, and `serve.test_lifeline`: 27 tests run, 24 passed, 3 platform skips, in 7.226 seconds.
- `git diff --check`.

The new regression can be run with `python -m unittest discover -s tests/terminal -p test_default_object_access.py -v`. The combined run used `unittest` discovery for the three terminal files plus `serve.test_lifeline`, with TEMP/TMP in a private directory declared under STRATA_STATE_DIR.

**Failed:**
- Expected before-fix regression on the unchanged base: `live child became unreadable after adopting user defaults`.
- An initial private-file test run under a shared, non-profile temporary directory had one failed assertion and two errors because that fixture did not meet those tests' private-inheritance/repair-root assumptions. Repeating under a private declared state root passed; no repair boundaries were relaxed.

**Not run:**
- Full repository suite on this public branch, model inference, Linux/macOS, CUDA/HIP/SYCL builds. No native engine files changed.

## Limits

This restores access for the same existing token-default principals; it does not grant access to other users or bypass ownership verification. It does not establish a model performance gain or general adaptive-runtime qualification.