BaseContainer: Ephemeral sandbox lifecycle cleanup (Part 1)

[jsidewhite]

BaseContainer: Ephemeral sandbox lifecycle tracking

Implements proper AppContainer profile cleanup for the BaseContainer runner when destroy_on_exit: true is configured.

What it does

• Ephemeral identities: Every BaseContainer launch gets a unique sandbox-{random hex} identity, ensuring no profile collisions between concurrent sandboxes.
• Registry tracking: Before launch, writes a tracking entry under HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\ProcessSandboxes\Mappings\{SID} with metadata (identity, SID, origin, requested identity, timestamps). A volatile Active subkey marks in-flight sandboxes for crash detection.
• Cleanup on exit: ==FUTURE==
• Deferred cleanup: If a network proxy is configured, cleanup is skipped (proxy state can't be torn down yet). A CleanupDeferred marker is written to the tracking entry for future tooling.
• Ctrl+C handling: Registers a console control handler so ==FUTURE== cleanup still runs on interrupt.
• No-op when destroy_on_exit: false: No tracking, no cleanup -- the profile persists across runs.

Why

Previously, BaseContainer never cleaned up AppContainer profiles. Over time this leaks registry state and BFS policies. This in the ==FUTURE== brings BaseContainer in line with LXC's existing cleanup behavior and follows the Tessera sandbox lifecycle spec.

This PR adds ephemeral sandbox lifecycle cleanup to the BaseContainer runner. When destroy_on_exit: true, each sandbox gets a unique random identity (sandbox-{hex}), a registry tracking entry under HKCU...\ProcessSandboxes\Mappings{SID} for crash recoverability. It also installs a Ctrl+C handler so cleanup runs on interrupt, and defers cleanup when a network proxy is active since proxy state can't yet be torn down.

Architecture

 ┌─────────────────────────────────────────────────────────┐
 │              base_container_runner.rs                    │
 │  (ScriptRunner::run_script)                             │
 │                                                         │
 │  1. Generate ephemeral identity ──┐                     │
 │  2. Derive SID                    │                     │
 │  3. Write tracking entry ─────────┼──► Registry         │
 │  4. Register Ctrl+C handler       │    (HKCU\...\       │
 │  5. CreateProcessInSandbox        │     Mappings\{SID}) │
 │  6. WaitForSingleObject           │                     │
 │  7. run_sandbox_cleanup() // FUTURE ────────┘                     │
 │       ├─► filesystem_bfs::clear_policy()                │
 │       ├─► DeleteAppContainerProfile()                   │
 │       └─► delete_tracking_key()                         │
 │                                                         │
 │  [proxy?] ──► mark_cleanup_deferred()                   │
 │  [Ctrl+C] ──► ctrl_handler() ──► cleanup or defer      │
 └─────────────────────────────────────────────────────────┘

[jsidewhite]

run_sandbox_cleanup

@bbonaby - do I need an RAII-like container for this cleanup in case someone early returns or an exception happens?

(early return on line 617, for example)

[jsidewhite]

@copilot do i need to wrap run_sandbox_cleanup in an RAII-like type?

[bbonaby]

Just seeing this but I believe so, for what it's worth you might be able to use the scopeguard crate: https://crates.io/crates/scopeguard like you would with wil::scope_exit

[Copilot]

Pull request overview

This PR adds a Windows-only lifecycle tracking + cleanup mechanism for the BaseContainer backend to support lifecycle.destroy_on_exit: true, aiming to prevent long-term leaks of AppContainer profiles and BFS filesystem policy state.

Changes:

• Added a new sandbox_tracking module that records per-sandbox tracking info in the registry, supports best-effort cleanup (BFS policy removal + AppContainer profile deletion), and installs a console control handler for interrupt cleanup.
• Updated BaseContainerRunner to mint ephemeral sandbox-{hex} identities when destroy_on_exit is enabled, write a pre-launch tracking entry, and perform best-effort cleanup on exit/failure/interrupt.
• Added FileSystemBfsManager::clear_policy to allow cleanup even when the BFS manager wasn’t previously “configured” within the current process.

Show a summary per file

File	Description
src/wxc_common/src/sandbox_tracking.rs	New registry-based tracking + cleanup helpers, plus Ctrl+C/console-close cleanup hook and unit tests.
src/wxc_common/src/lib.rs	Exposes the new sandbox_tracking module on Windows builds.
src/wxc_common/src/filesystem_bfs.rs	Adds clear_policy() helper to unconditionally clear BFS policy for an identity.
src/wxc_common/src/base_container_runner.rs	Integrates ephemeral identity + tracking + cleanup into BaseContainer process launch and exit flow.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 7