Run Windows session ACL operations asynchronously

[sylvesterkaczmarek]

Fixes #647.

Windows initialization and reset run session ACL subprocesses synchronously. A slow grant, stamp or cleanup blocks the embedding process's event loop for up to the 60-second subprocess timeout, interrupting unrelated heartbeats and requests.

Add asynchronous grant, stamp, revoke and restore helpers using the existing asynchronous subprocess runner. Await them during initialization, rollback and normal reset, preserving operation order, error codes, timeouts and per-path cleanup diagnostics.

Serialize initialization and reset so teardown cannot clear the session identity during an outstanding ACL operation. Keep synchronous cleanup for the process exit handler, where Node cannot await promises. Existing synchronous public helpers remain available.

Validation

• Eight lifecycle tests use real delayed subprocesses to check responsiveness, ordering, rollback and cleanup diagnostics, concurrent reset, reinitialization and process exit. Seven fail on the original code; the exit control passes.
• Windows-wrapper and public-export suites: 44 passed, 65 platform-specific skips, 0 failures.
• Build, source and test typechecking, changed-file ESLint, Prettier and git diff --check passed.
• Native Windows ACL enforcement was not exercised on the Linux test host.

[sylvesterkaczmarek]

Refreshed onto current main and updated the lifecycle fixture for the new literal-path input type. Build, source/test typechecking, lint and formatting pass; the Windows-wrapper/export suite passes 45 tests with 64 platform skips on macOS. The eight lifecycle cases use real delayed subprocesses; native Windows ACL enforcement is not claimed from that local run. Could you review the refreshed head? The current Tests workflow requires maintainer approval: https://github.com/anthropics/sandbox-runtime/actions/runs/37550153813.