Add packaged DLP broker and protected Windows service foundation

tests/fixtures/broker-process-child.cjs

@@ -0,0 +1,19 @@
+'use strict';
+// Synthetic classification belongs only in this explicitly test-only factory.
+const fs=require('node:fs');
+const path=require('node:path');
+const https=require('node:https');
+const {runBrokerProcess}=require('../../apps/network-broker/process-entry.cjs');
+const {createConnectProxy}=require('../../apps/network-broker/connect-inspection-proxy.cjs');
+const cert=fs.readFileSync(path.join(__dirname,'icap/cert.pem'));
+const key=fs.readFileSync(path.join(__dirname,'icap/key.pem'));
+runBrokerProcess(config=>{
+  if(Object.keys(config).join(',')!=='destination'||typeof config.destination!=='string'||!/^localhost:[1-9][0-9]{0,4}$/.test(config.destination))throw Error('invalid-test-config');
+  const port=Number(config.destination.split(':')[1]);if(port>65535)throw Error('invalid-test-config');
+  return createConnectProxy({authority:'synthetic-test-policy',current:()=>true,resolveCertificate:binding=>binding.authority===config.destination?{authority:config.destination,key,cert}:undefined,inspect:({body})=>({decision:body.toString().includes('SECRET')?'block':'allow'}),forward:({request,body,signal,maxResponseBytes})=>new Promise((resolve,reject)=>{
+    const outgoing=https.request({host:'127.0.0.1',port,path:new URL(request.url).pathname,method:request.method,servername:'localhost',ca:cert,rejectUnauthorized:true,signal,headers:{host:config.destination,'content-length':body.length}},res=>{
+      const chunks=[];let bytes=0;
+      res.on('data',chunk=>{bytes+=chunk.length;if(bytes>maxResponseBytes){outgoing.destroy();reject(Error('response-bound'));return;}chunks.push(Buffer.from(chunk));});res.on('end',()=>resolve({statusCode:res.statusCode,headers:res.headers,body:Buffer.concat(chunks)}));res.on('error',reject);
+    });outgoing.on('error',reject);outgoing.end(body);
+  }),deadlineMs:1000,authMode:'bearer'});
+});