When `process.cwd` was empty, the AppContainer and BaseContainer runners
passed a NULL current directory to `CreateProcessW`, so the child inherited
the host process's cwd. Under a deny-by-default AppContainer token that
directory is often unopenable, and the kernel then silently resets the
child to the drive root (`C:\`) instead of failing the launch — surfacing
as sandboxed shells starting on `C:\` rather than the working directory
(notably via the in-process Rust SDK, whose host cwd is the caller's, not a
granted path).

Mirror the Seatbelt backend's resolver: add
`ExecutionRequest::resolved_working_directory()` (explicit `working_directory`
wins, else the first `readwrite` path, else the first `readonly` path) and use
it in both Windows runners so an unset cwd defaults to a directory the sandbox
token can actually open.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a38efe5c-db9c-4ad7-a1c6-537b6cc3df4f
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

The resolver only picks the first policy path; it does not verify the path
exists or is a directory, so drop the "guaranteed to open" wording. Also
note that the schema example's defaulting is backend-specific rather than a
universal rule.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a38efe5c-db9c-4ad7-a1c6-537b6cc3df4f
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Condense the `resolved_working_directory` doc comment and replace the
duplicated rationale at both runner call sites with a one-line pointer to
the function, keeping the explanation in a single place.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a38efe5c-db9c-4ad7-a1c6-537b6cc3df4f
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

The resolver unit tests only cover path selection, so they would still pass
if either Windows runner ignored `resolved_working_directory()` and passed a
NULL current directory to the launch API. Add the missing end-to-end coverage,
mirroring the Seatbelt relative-file probe:

* `processcontainer_runs_in_first_readwrite_path_when_process_cwd_empty` —
  empty `process.cwd`, two granted directories, and a relative output file;
  the launcher cwd is the *second* granted path, so a NULL-cwd regression is
  openable by the token and lands the probe there instead.
* `processcontainer_honors_explicit_process_cwd` — an explicit cwd wins over
  the policy-path fallback (the fallback path is listed first).

The tier (BaseContainer vs AppContainer+DACL) is not independently selectable
from a config: the dispatcher derives it from host capability and the
MXC_FORCE_TIER seam is cfg(test)-only, so it has no effect on the production
wxc-exec.exe. The tests exercise whichever tier the prepared lane resolves to;
both tiers are covered by running the suite on a BaseContainer-capable and a
downlevel host. Documented in the module header, which also no longer claims
cwd is out of scope.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 367b5917-43d7-4288-9fce-d28ed9711268
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>