TJZF-4j97/dsh-sandbox-console-fix

DeepSeek Harness Windows bundle: gives the ACL sandbox runner a console so confined pwsh/cmd/powershell start again under workspace-write (read-only was never affected). Merges one `Everyone` full-access ACE into the runner process token Default DACL (the same ACE the shipped read-only path already merges) and changes nothing else in the token, the ACLs, the integrity label or the policy.