fix(windows): retry native-main ACL timeout once

[luvs01]

Summary

• preserve typed ACL error codes and let native-main owner/lock acquisition consume exactly one fresh-budget retry after an ETIMEDOUT memo
• fail closed after that retry with EACLRETRYEXHAUSTED, while ignoring prose-only timeout lookalikes
• keep the change scoped as a follow-up to [Bug]: Windows NTFS에서 ACL hardening이 5초 후 ETIMEDOUT으로 실패하며 파일시스템 미지원으로 오인 표시됨 #160, [Bug]: synchronous Windows ACL hardening stalls the proxy on response-state writes #612, and Dashboard shows no data when ACL hardening cannot be verified (management API fails closed), plus a permanent false startup-protection warning and a 10s first paint #766; it is adjacent to but does not replace Native-profile lock deadlock: all native requests 503 with zero profiles registered, and account main recover cannot clear it #1120 or fix(codex): skip empty native-profile stage sweeps #1124

Verification

• Bun 1.3.14: 6 targeted retry, memo, and native-main owner tests passed
• Bun 1.4.0-canary.1: the same 6 tests passed
• bun run typecheck
• bun run privacy:scan
• git diff --check
• On the validating Windows host, broader real-icacls tests retain the same environmental EICACLS baseline failures on unmodified dev; this PR does not claim a full-green local Windows suite

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (No user-visible configuration or workflow changed.)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 749870a4-c045-41ac-95cc-e402f4db2b5d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/lib/windows-secret-acl.ts.

[luvs01]

Closing as a duplicate of #1130. That draft contains the same implementation plus the final test-fixture isolation used for the green affected-file run.