Prefer the provisioning service for automatic Windows sandbox setup

[copyberry]

Prefer the provisioning service for automatic Windows sandbox setup

What changed

• Use the installed provisioning service regardless of the onboarding feature gate. Fall back to the elevated helper only when the service is unavailable; propagate service errors.
• Pass the effective proxy settings and filter listener ports to match them, including when preserving saved settings.
• Remove stale credentials before repairing missing, disabled, or password-expired sandbox accounts so older services cannot mistake them for completed setup.
• Select helper fallback when workload-identity environment variables are present, since service requests do not carry that environment. Continue rejecting helper fallback for registered Core.

Testing

Extend account-repair tests to cover stale credential removal, missing and disabled accounts, and repeated setup checks. Add subprocess tests for workload-identity routing with and without registered Core.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}