fix(host-prep): avoid recursive ACL propagation on drive roots

[xuli500177]

📖 Description

prepare-system-drive and unprepare-system-drive currently finish their DACL writes with SetNamedSecurityInfoW. Windows automatically imposes the current inheritance model on descendants for that API, so preparing a legacy or inheritance-inconsistent data-volume root can recursively rewrite thousands of child security descriptors and appear to hang.

This change:

• adds a target-only DACL write mode backed by an absolute security descriptor and SetFileSecurityW;
• routes only the persistent host-prep prepare/unprepare helpers through that mode;
• keeps the runtime DaclManager on SetNamedSecurityInfoW, because its inheritable per-run grants intentionally propagate;
• adds a Windows regression test that creates an inheritance-inconsistent parent/child tree and verifies the child's raw DACL bytes do not change on either apply or revoke;
• documents the non-propagating behavior.

SetFileSecurityW is a legacy API, but its documented directory behavior is the property needed here: security applied to the named directory is not inherited by its children.

🔗 References

Resolves #648

• SetNamedSecurityInfoW automatic inheritance behavior
• SetFileSecurityW target-only directory behavior

🔍 Validation

• cargo fmt --all -- --check
• cargo check -p wxc_common -p wxc_host_prep
• cargo clippy -p wxc_common -p wxc_host_prep --all-targets -- -D warnings
• cargo test -p wxc_common — 395 passed
• cargo test -p wxc_common target_only_writes_leave_descendant_dacl_unchanged — 1 passed
• wxc_host_prep ... system_drive --nocapture — 9 passed (debug test copy with an explicit asInvoker manifest to bypass Windows installer-detection elevation heuristics)

✅ Checklist

• Signed the Contributor License Agreement (will complete if prompted)
• Linked to an issue
• Updated documentation
• Updated Copilot instructions (not applicable; no build, architecture, or convention change)
• Cargo.lock is unchanged, so dependency-feed-check dependency seeding is not applicable

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

This PR fixes wxc-host-prep prepare-system-drive / unprepare-system-drive unintentionally triggering recursive ACL normalization on large drive roots by avoiding SetNamedSecurityInfoW’s automatic inheritance propagation behavior. It introduces a target-only DACL write path in wxc_common::filesystem_dacl (backed by an absolute security descriptor + SetFileSecurityW), routes host-prep’s persistent drive-root operations through it, and adds a regression test and documentation to codify the “no descendant mutation” contract.

Changes:

• Add a DaclWriteMode abstraction and SetFileSecurityW-backed “target-only” DACL write path in wxc_common::filesystem_dacl.
• Switch host-prep system-drive apply/revoke to the non-propagating write helpers, while keeping the existing propagating behavior available for runtime DACL management.
• Add a Windows regression test asserting descendant DACL bytes are unchanged, and update docs/host-prep.md to document the suppression of automatic propagation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/host/wxc_host_prep/src/system_drive/mod.rs	Routes system-drive prepare/unprepare to the new non-propagating DACL write helpers while keeping existing test-only use of propagating helpers.
src/core/wxc_common/src/filesystem_dacl.rs	Introduces DaclWriteMode + write_dacl() with a target-only SetFileSecurityW path; adds public *_no_propagation helper APIs and a regression test.
docs/host-prep.md	Documents that drive-root ACL writes suppress automatic inheritance propagation and avoid normalizing descendant ACLs.

[xuli500177]

@microsoft-github-policy-service agree