Handle disabled Windows sandbox accounts during cleanup

[copyberry]

Handle disabled Windows sandbox accounts during cleanup

Why

Cleanup needs fresh logon tokens for sandbox accounts that may already be disabled. Temporarily enabling those accounts must leave a durable obligation to disable them again if the service exits unexpectedly.

What changed

• Persist cleanup_logon_pending before enabling an account, then disable it again after the logon attempt before clearing the marker.
• Recover pending account disables before owner restoration or IPC admission, validating account SIDs before restoration. Block runtime readiness and provisioning while recovery is pending, and defer retirement until cleanup logons are prepared.
• Include the blocking logon details in cleanup timeout errors and suppress repeated identical cleanup errors in the Windows event log.

Testing

Add receipt tests covering backward-compatible defaults and pending cleanup state surviving serialization, blocking readiness and owner admission until cleared.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}