#3428 [Other] Fix Windows child process permissions in adopt_user_defaults

Descrição

## Problem and result

I ran into this while starting a locally built engine on Windows. The server was healthy, but my PowerShell helper for setting HighQoS kept timing out because it couldn't read `strata.exe`'s path. Trying `OpenProcess` directly returned error 5 (`ERROR_ACCESS_DENIED`), even though the engine was running under the same user.

The cause is the `FA` entries in the token default DACL set by `adopt_user_defaults()`. `FA` means `FILE_ALL_ACCESS` (`0x1f01ff`), but that default DACL is also used when creating child processes. The file access mask doesn't include the process query and set-information rights needed here.

Changing these entries to `GA` lets Windows map the permissions to the object being created. With this change, reopening a child process and setting its QoS works without elevation.

## Related discussion

None. The `FA` token default was added in `df13760c`.

## Approach

The fix only changes `FA` to `GA` in the token default DACL. The user, SYSTEM and Administrators entries stay the same. The separate ACLs used to make files private are untouched.

The regression test calls `adopt_user_defaults()`, starts a Python child, then reopens it with `PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_SET_INFORMATION` and calls `winjob.no_throttle()`. It runs in a separate Python process so it doesn't change the test runner's token defaults.

Non-Windows code still returns before this point. There are no engine or GPU backend changes.

## Validation

Tested without elevation on Windows 11, build `10.0.26300`, with 64-bit Python 3.13.2 (Anaconda) from the project's `.venv`.

The patched tree is based on `9ae93f7b1fe989d04a8e404d32cddaeeff10505f`, on branch `fix/windows-child-process-default-dacl`. Commands were run from the repo root using that environment.

**Passed:**

```text
python -m unittest discover -s tests/terminal -p test_private_files.py -v

Ran 14 tests
OK (skipped=1)
```

That's 13 passed, with the POSIX mode-bit test skipped on Windows. This includes the new process-access test and the existing file-ACL tests.

`git diff --check` also passed with no output.

**Failed:**

Before changing the DACL, the new test reproduced the access denial:

```text
python -m unittest discover -s tests/terminal -p test_private_files.py -k default_dacl -v

AssertionError: OpenProcess failed: 5
FAILED (failures=1)
```

That run was before syncing main; the affected `FA` code was unchanged by the sync. The post-fix run above is on the updated base. No failures in that run.

**Not run:**

- The full Terminal/Control suite.
- Linux/macOS, or the new test from an elevated Windows session.
- A full model-server restart on the updated base. The new test uses a Python child and real Windows process/QoS calls, without loading a model.
- GPU builds or benchmarks, since this doesn't change backend code.

## Limits

The server needs a restart. This doesn't repair the token defaults or ACLs of processes that are already running.

The test checks that reopening the child and setting QoS succeed; it doesn't read back the throttling state. This also doesn't mean Strata's built-in QoS setup was failing: it uses the handle returned when the child is created, rather than reopening it by PID.