Route Windows sandbox proxy traffic by restricting SID

[copyberry]

Route Windows sandbox proxy traffic by restricting SID

Why

Elevated Windows sandboxes need stable managed-proxy ports while preserving the network policy and environment attribution of each sandboxed process.

What changed

• Keep shared HTTP and SOCKS5 loopback ingress listeners alive across managed-proxy instances.
• Add a per-route restricting SID to elevated sandbox tokens and dispatch incoming connections to the matching proxy policy after attributing the client process.
• Reject connections without exactly one registered route, remove routes when their proxy handle is dropped, and keep unsandboxed Windows launches off the managed ingress.
• Provision the elevated sandbox with the configured proxy ports and local-binding setting, honoring the selected profile and CLI overrides.

Testing

• Add Windows unit tests for TCP ownership attribution, route selection, restricting-token propagation, and setup settings.
• Add an end-to-end Windows test covering stable ports, isolated environment policies, HTTP and SOCKS5 routing, and route teardown.