fix(runtime-host): tolerate slow Windows ACL startup

[M4n5ter]

English

Summary

The Windows release smoke in npm Nightly run 34917337079 refused an otherwise healthy Runtime Host after Windows PowerShell 5.1 exceeded the 30-second named-pipe ACL deadline. This is the same hosted-runner cold-start variance that #3235 previously moved from 10 to 30 seconds.

• Raise the fail-closed ACL helper budget to 60 seconds and move the dependent election, readiness, and Windows trust-fixture deadlines to 75 seconds.
• Keep the ACL and every failure path unchanged: the endpoint is still refused unless the current-user restriction is confirmed.
• Remove the Bash-only >&2 redirection from the cross-platform first-Node failure reporter so the original smoke failure remains readable under pwsh.

Verification

• npm ci --ignore-scripts --no-audit
• npm run format:check
• npm run lint
• npm --workspace @maka/runtime-host run typecheck
• Targeted Runtime Host tests: 15 passed
• node --test scripts/release-cli-workflow-policy.test.mjs: 11 passed
• Full Runtime Host suite: 1,928 passed and 19 skipped; two unrelated concurrent timing tests failed, then both passed when rerun individually
• npm run build: the affected dependency chain through Runtime Host and CLI built successfully; the repository build later stopped in unchanged @maka/ui sources on existing prop/type mismatches (settledText, autoScroll, and trailingAction)

Not run locally: the Windows-only ACL trust fixture. The pull request CI is the executable Windows coverage.

Security

This changes only how long startup waits for the named-pipe DACL operation. It does not change the descriptor, admitted principals, or fail-closed behavior. The 75-second callers deliberately outlast the 60-second security helper so they preserve its diagnostic instead of timing out first.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex investigated the Actions failures, implemented the timeout alignment and workflow portability fix, ran verification, and drafted this pull request description.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

摘要

npm Nightly run 34917337079 的 Windows 安装包验证中，Windows PowerShell 5.1 启动超过 30 秒，Runtime Host 因无法在时限内确认命名管道 ACL 而拒绝启动。这不是权限设置本身失败，而是 #3235 曾处理过的 hosted runner 冷启动波动再次越过了当时留下的上限。

• 将 ACL 助手的超时从 30 秒调整到 60 秒，并把依赖它的选主、就绪等待和 Windows 信任边界 fixture 统一调整到 75 秒。
• 不改变 DACL 内容和失败策略：只有明确确认管道已限制为当前用户后，Runtime Host 才会继续启动。
• 去掉首个 Node 版本失败报告中的 Bash 专用 >&2，避免 Windows 默认 pwsh 再抛一个语法错误、干扰原始失败信息。

验证

• npm ci --ignore-scripts --no-audit
• npm run format:check
• npm run lint
• npm --workspace @maka/runtime-host run typecheck
• Runtime Host 针对性测试：15 项通过
• node --test scripts/release-cli-workflow-policy.test.mjs：11 项通过
• Runtime Host 全量测试：1,928 项通过、19 项跳过；两个无关的并发时序用例首次失败，分别单独重跑后均通过
• npm run build：本次涉及的依赖链、Runtime Host 和 CLI 均构建成功；随后在未改动的 @maka/ui 中因已有的 settledText、autoScroll、trailingAction 属性类型不一致而停止

本地未运行 Windows 专属 ACL 信任边界 fixture；该路径由 PR 的 Windows CI 实机验证。

安全性

本次只延长确认命名管道 DACL 的等待时间，不改变安全描述符、允许访问的主体或失败即拒绝的原则。上层 75 秒 deadline 刻意长于 ACL 助手的 60 秒上限，确保真正的安全检查结果和诊断信息优先返回。

AI 使用说明

二选一：

• 没有生成式工具实质参与
• 有生成式工具实质参与

工具及范围：Codex 负责排查 Actions 失败、实现超时链路和 workflow 兼容性修复、执行验证，并协助起草本 PR 说明。

检查清单

• 测试覆盖本次行为变更，旧实现下会失败
• lint、格式、类型检查及受影响测试均在本地通过

本 PR 是否改变现有行为？

• 是，已在“摘要”中说明
• 否

[jackwener]

Approved at exact head b55ecb8762088ea5ed5c2915da673a6edbdf0f0e at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts full responsibility for subsequent handling.

At submission time, the PR was open, non-draft, and mergeable. The exact-head test, Windows package, and windows_recovery checks had completed successfully. GitHub reported the optional Eval validation job as skipped; this approval does not claim that the skipped check passed, is not a merge decision, and no merge was performed.

---

Review notice: This approval was submitted by an automated review agent operated by jackwener and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.