fix: stabilize Windows credential ACL verification

[kmbroai]

Summary

• Run the Windows credential ACL inspection test through asynchronous execFile so transient synchronous-process failures do not surface only as an unexplained status: null.
• Retry bounded Windows credential descendant enumeration when a concurrent ambient-auth import removes a temporary file between directory traversal and lstat.
• Allow 60 seconds per test only on Windows CI, where managed-credential integration tests already take 16-28 seconds and can cross the default 30-second limit under normal runner contention.
• Keep missing credential-home roots, persistent descendant instability, symbolic links, and other filesystem failures fail-closed.
• Cover a disappearing descendant, repeated disappearance, a missing credential-home root, and the Windows-only CI timeout configuration with deterministic regression tests.

Failure evidence

• Windows/Node 24 on main: https://github.com/openai/codex-security/actions/runs/31132067211/job/92723068033
• Windows/Node 22 concurrent credential import: https://github.com/openai/codex-security/actions/runs/31127158645/job/92702598234
• First PR run: the original Windows/Node 24 PowerShell failure and all new credential regressions passed, but a different managed-credential integration test reached the 30-second suite limit: https://github.com/openai/codex-security/actions/runs/31135518651/job/92733857846

Verification

• New disappearing-descendant and persistent-instability regressions failed against the unmodified implementation, then passed with the fix.
• The Windows-only CI-timeout regression failed against the unmodified workflow, then passed with the platform-specific override.
• Focused runtime suite: 106 passed, 7 Windows-only skips, 0 failed.
• Randomized complete SDK suite (--randomize --seed 12345) on the final commit: 945 passed, 10 platform-specific skips, 0 failed.
• TypeScript typecheck, generated-model validation, full Prettier check, and production build passed.
• pnpm pack and pnpm run check:package passed, including an installed-package smoke test, 106 bundled plugin files, and 198 archive entries.
• The first pull-request matrix confirmed the original Windows-only PowerShell integration check and every new credential regression pass on both real Windows runners.