Add packaged DLP broker and protected Windows service foundation

tests/fixtures/broker-inspector-environment.cjs

@@ -0,0 +1,19 @@
+'use strict';
+// Diagnostic fixture only: compare explicitly allowlisted environment profiles
+// against a real packaged contained inspector. No private content or values.
+const path=require('node:path');
+const {startInspector}=require('../../apps/browser/inspection.cjs');
+const {execFileSync}=require('node:child_process');
+function children(){const text=execFileSync('C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe',['-NoProfile','-NonInteractive','-Command',`@(Get-CimInstance Win32_Process -Filter "ParentProcessId = ${process.pid}" | Where-Object Name -eq 'python.exe' | Select-Object -ExpandProperty ProcessId) | ConvertTo-Json -Compress`],{encoding:'utf8',windowsHide:true,timeout:10000}).trim();return text?[].concat(JSON.parse(text)):[];}
+async function main(){
+ const {defaultPolicy}=await import('../../packages/core/policy.mjs');const baseline={...process.env},root=path.resolve(__dirname,'../../.runtime/windows');
+ for(const variant of ['stripped','profile']){
+  const allowed=['SystemRoot','WINDIR','TEMP','TMP',...(variant==='profile'?['USERPROFILE','LOCALAPPDATA','APPDATA']:[])];for(const key of Object.keys(process.env))delete process.env[key];for(const key of allowed)if(baseline[key])process.env[key]=baseline[key];
+  let inspector,stage='startup',result;
+  try{inspector=startInspector(root,true);if(!inspector)throw Error('fixed-path-fault');await inspector.waitReady();stage='scan';const answer=await inspector.inspect(Buffer.from('public synthetic text'),defaultPolicy());result={variant,stage,decision:answer.decision,complete:answer.coverage.complete};}
+  catch{result={variant,stage,failed:true};}
+  finally{inspector?.stop();for(let count=0;count<20&&children().length;count++)await new Promise(resolve=>setTimeout(resolve,100));result.ownedParents=children().length;}
+  process.stdout.write(JSON.stringify(result)+'\n');if(result.ownedParents)throw Error('fixed-cleanup-fault');
+ }
+}
+main().catch(()=>{process.stderr.write('fixed-environment-proof-fault\n');process.exitCode=1;});