Add capture ETL retention option

[Richie Gomez (richiemsft)]

📖 Description

Add processContainer.captureDenials.retainEtl so callers can preserve the sealed ETL trace after canonical denial analysis.

• Defaults to false, preserving the existing delete-after-analysis behavior.
• Reports the retained trace as optional etlPath capture metadata and in the CLI pointer.
• Preserves and identifies the ETL when analysis or teardown fails, including simultaneous timeout/wait failures.
• Exposes the setting through the Rust SDK policy and the metadata through Rust/FFI/C# surfaces.
• Regenerates the dev schema and TypeScript wire contract and documents sensitive-trace handling.

🔗 References

Closes #772

🔍 Validation

• Full tests for wxc_common, mxc_engine, appcontainer_common, mxc-sdk, wxc, and mxc_ffi using the pinned Rust 1.93 toolchain.
• Rust format and Clippy with warnings denied for affected crates.
• Node SDK unit and wire-conformance tests.
• C# retained metadata deserialization test.
• Schema codegen, SDK wire codegen, schema-version sync, and 197 config validations.
• Complete local diff review after implementation; no remaining findings.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds optional retention of sensitive ETL traces produced by ProcessContainer denial capture.

Changes:

• Adds retainEtl across wire, domain, schema, and Rust SDK policy models.
• Preserves retained traces and reports etlPath through CLI, Rust/FFI, and C# metadata.
• Improves teardown error propagation and adds retention/default-cleanup tests and documentation.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/core/wxc/src/main.rs	Updates audit validation test data.
src/core/wxc_common/src/wire.rs	Adds the wire-format retention option.
src/core/wxc_common/src/sandbox_process.rs	Preserves teardown details in timeout errors.
src/core/wxc_common/src/models.rs	Adds domain configuration and ETL metadata.
src/core/wxc_common/src/config_parser.rs	Parses retainEtl with a false default.
src/core/mxc-sdk/src/sandbox.rs	Updates SDK metadata tests.
src/core/mxc-sdk/README.md	Documents Rust SDK retention usage.
src/core/mxc_engine/src/policy.rs	Exposes and emits the Rust policy option.
src/backends/appcontainer/common/src/base_container_runner.rs	Implements ETL retention, cleanup, and error reporting.
sdk/node/src/generated/wire.ts	Regenerates the TypeScript wire contract.
sdk/dotnet/README.md	Documents retained ETL metadata.
sdk/dotnet/Microsoft.Mxc.Sdk/SandboxOutputMetadata.cs	Exposes EtlPath in C#.
sdk/dotnet/Microsoft.Mxc.Sdk.Tests/MxcSandboxTests.cs	Tests C# metadata deserialization.
schemas/dev/mxc-config.schema.0.8.0-dev.json	Adds retainEtl to the dev schema.
docs/schema.md	Documents the configuration field.
docs/learning-mode/capabilities.md	Documents retention behavior and security responsibilities.

[Richie Gomez (richiemsft)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).