Windows: Default to icacls vs winapi to avoid EDR-hook related crash

[hdm]

This works around a bug where CrowdStrike's EDR hooks corrupt the Go heap when the ACL APIs are called directly by calling out to the icacls command-line.

[Copilot]

Pull request overview

This PR changes how Windows ACLs are applied during browser install/launch to avoid Go heap corruption observed when CrowdStrike Falcon EDR hooks Win32 ACL APIs. It defaults to shelling out to icacls (with an opt-in flag to use the in-process Win32 ACL path), and adds Windows-only tests plus CI coverage to validate both backends.

Changes:

• Default Windows permission/ownership operations to an icacls-based implementation, with a UseWinACLAPI escape hatch to force the Win32 API backend.
• Add Windows ACL backend tests to validate equivalence and dispatcher behavior, and wire them into the Windows workflow.
• Refactor osEnsureApplicationPermissions into a (*Browser) method for consistency with the new backend routing.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
lib/launcher/os_windows.go	Adds icacls backend, dispatcher methods honoring UseWinACLAPI, and switches callers to the dispatchers.
lib/launcher/os_windows_acl_test.go	Adds Windows-only tests that exercise both ACL backends and dispatcher routing.
lib/launcher/os_unix.go	Refactors osEnsureApplicationPermissions into a (*Browser) method (no behavior change).
lib/launcher/browser.go	Introduces UseWinACLAPI field + WithUseWinACLAPI option; updates install path to call the new method receiver.
.github/workflows/winacl_windows.yml	Runs the new launcher ACL backend tests on Windows CI.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.