feat: complete WorkBuddy parity and Windows release workflow

resources/sandbox/win32-x64/python-sitecustomize.py

@@ -0,0 +1,23 @@
+"""Keep private Windows temporary directories accessible to this AppContainer.
+
+Python 3.13+ gives mode 0o700 an explicit user/admin DACL on Windows. That
+omits the AppContainer SID. Inside our stage, inherit the native private parent
+DACL instead. Kernel permissions and the Job remain the security boundary.
+"""
+import os
+
+if os.name == "nt" and os.environ.get("YCODE_SANDBOX") == "appcontainer":
+    _mkdir = os.mkdir
+    _stage = os.path.normcase(os.path.abspath(os.environ["YCODE_SANDBOX_ROOT"]))
+
+    def _private_mkdir(path, mode=0o777, *, dir_fd=None):
+        if mode == 0o700 and dir_fd is None:
+            target = os.path.normcase(os.path.abspath(os.fsdecode(path)))
+            try:
+                if os.path.commonpath((_stage, target)) == _stage:
+                    mode = 0o777
+            except ValueError:
+                pass
+        return _mkdir(path, mode, dir_fd=dir_fd)
+
+    os.mkdir = _private_mkdir