feat(scripting): ScriptWorker isolation on Windows: restricted worker identity, pipe ACL, firewall + PeCacheDir installer (lmxopcua#780)

Owner decisions §14 #5/#6 as built (design §12.5):

- Scripting:Worker:Identity (default unset, Windows only, fail-closed validation): each worker
  starts under a restricted token derived from the host's. Every privilege but SeChangeNotify is
  removed; the restricting SIDs are NT SERVICE\OtOpcUaScriptWorker's SID + Everyone + Users +
  RESTRICTED; the token and default DACLs are host + SYSTEM + identity + RESTRICTED. The worker
  is created suspended, put in its Job Object before it runs, inherits only its stdio pipes, gets
  an ACL'd work dir as TEMP, and runs with DOTNET_EnableDiagnostics=0. The identity is granted on
  the host's window station and desktop, because USER32 init made coreclr.dll fail with
  ERROR_DLL_INIT_FAILED on windev. The logon SID is not used because the host's process DACL
  gives it PROCESS_VM_READ.
- The worker pipe on Windows always has an explicit protected DACL: host account + identity
  only. There is no owner ACE, so an elevated host's Administrators gets no access.
- The worker treats access denied on its parent-pid poll as alive; the Job Object covers that case.
- scripts/install/Install-ScriptWorkerIsolation.ps1 + ScriptWorkerIsolation.psm1 are idempotent
  and support -WhatIf, -Uninstall and -PlanOnly. They create the disabled anchor service, the
  PeCacheDir ACL (protected, no Users, key and markers host-only, pe\ Modify for the identity),
  read+execute on script-worker\, a ReadData deny on the install root, the outbound firewall
  block on the worker exe, and optionally the host-service env.
- Tests: the dry-run harness scripts/install/tests/Test-ScriptWorkerIsolation.ps1 (46
  assertions, mutation-checked); ScriptWorkerIdentityTests; WorkerIsolationTests, which cover
  the pipe ACL, token access and a real restricted worker running a script, all green on windev.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/ScriptRunnerSelection.cs

@@ -68,7 +68,8 @@ public sealed class ScriptRunnerSelection : IScriptRunnerProvider, IAsyncDisposa
 
     /// <summary>
     ///     Startup checks for the runner options: returns the Warnings to log, and throws when the configuration must
-    ///     not start (a <c>PeCacheDir</c> that is relative or inside the content root — fail closed).
+    ///     not start (a <c>PeCacheDir</c> that is relative or inside the content root, or a <c>Worker:Identity</c> that
+    ///     is malformed or set off Windows — fail closed).
     /// </summary>
     /// <param name="options">The bound, sanitized <c>Scripting</c> options.</param>
     /// <param name="contentRootPath">The host's content root.</param>
@@ -82,6 +83,8 @@ public sealed class ScriptRunnerSelection : IScriptRunnerProvider, IAsyncDisposa
 
         if (options.Worker.ValidatePaths(contentRootPath) is { } violation)
             throw new InvalidOperationException($"Scripting misconfiguration: {violation}");
+        if (options.Worker.ValidateIdentity(OperatingSystem.IsWindows()) is { } identityViolation)
+            throw new InvalidOperationException($"Scripting misconfiguration: {identityViolation}");
 
         var mode = $"Scripting:Runner={options.Runner}";
         var shadow = options.Runner == ScriptRunnerMode.Shadow;

src/Server/ZB.MOM.WW.OtOpcUa.ScriptWorker/WorkerHost.cs

@@ -536,6 +536,13 @@ internal sealed class WorkerHost
         {
             return false;
         }
+        catch (System.ComponentModel.Win32Exception)
+        {
+            // Access denied: a worker under Scripting:Worker:Identity runs with a restricted token that may not open the
+            // host's process. It exists (GetProcessById found it), so it is alive; on Windows the Job Object's
+            // kill-on-close is what ends the worker with its host, and pipe end-of-stream backs it up.
+            return true;
+        }
     }
 
     private static void OnWriteFault(Exception ex)