feat(mxc): add Windows security presets

[ChazGo]

What Problem This Solves

The MXC plugin currently exposes low-level network and timeout settings, but it does not provide the Windows-aligned security presets used by the Windows node. Operators must assemble the intended network, standard-folder, clipboard, UI-isolation, and timeout behavior themselves, and clipboard-enabled policies can be ineffective when ProcessContainer UI isolation remains locked to the container.

The plugin also blocked activation by requiring the legacy IsoEnvBroker service. Current SF2 builds expose IsolationSession and IsoSessionCore, while MXC's normal process backend owns BaseContainer/AppContainer capability detection and does not require the legacy service name.

Why This Change Was Made

This adds plugin-owned Locked Down, Recommended, and Unprotected presets while preserving the existing advanced overrides and restrictive policy-file composition. The implementation resolves redirected Windows known folders for the Gateway identity, uses desktop isolation only when clipboard access is enabled, keeps internal shell commands locked down, and does not claim support for the Windows node output caps because the current sandbox backend contract has no complete output-limit seam.

Plugin activation now validates the packaged MXC executor and retains the advisory system-drive ACL check, but defers containment capability selection to MXC when a command executes. This removes the stale service-name coupling without adding a replacement dependency on IsolationSession.

User Impact

Windows MXC users can select a consistent security level instead of configuring each control independently:

Security level	Internet	Documents / Downloads / Desktop	Clipboard	UI isolation	Timeout
Locked Down	Off	None	None	Container	30 seconds
Recommended	On	Read-only	Read	Desktop	60 seconds
Unprotected	On	Read-write	Read-write	Desktop	300 seconds

Recommended is the default. Existing network: "none" configuration can still tighten a preset, explicit timeout values remain supported, and configured policy-file timeouts continue to act as ceilings. Modern SF2 hosts can activate the plugin without installing or enabling a legacy IsoEnvBroker service.

Evidence

• node scripts/run-vitest.mjs extensions/mxc - 12 files, 133 tests passed.
• The new plugin-registration regression fails against the pre-fix source with IsoEnvBroker service is not installed and passes after the readiness repair.
• node scripts/run-tsgo.mjs -p extensions/mxc/tsconfig.json - passed.
• Direct Oxlint run over the changed MXC TypeScript files - passed.
• git diff --check - passed.
• Independent P0/P1 fallback review after the final fixes - no findings. The repository's Codex autoreview helper was attempted but could not authenticate because this host has no Codex login.
• Added final-payload coverage for all three presets, redirected standard folders, writable workspaces nested under standard folders, clipboard isolation, restrictive network overrides, policy timeout ceilings, and locked-down internal shell commands.
• Confirmed on SF2 build 26683.1006 that IsolationSession and IsoSessionCore are installed while IsoEnvBroker is absent, matching the removed activation failure.
• Installed the replacement package on that SF2 host, loaded the plugin with zero diagnostics, selected backend mxc through openclaw sandbox explain, and completed one real Gateway agent turn whose single exec call returned MXC_PROCESS_OK. The temporary agent sandbox override was removed afterward and Gateway health remained 200.

The repository-wide changed-file gate passed its guards, formatting, plugin-boundary checks, and doctor-contract tests before reaching unrelated extension type failures caused by stale dependencies. A required dependency refresh then stopped on the configured package feed returning 404 for fast-uri@4.1.4; the MXC package's focused typecheck and complete test suite remain green. The replacement package completed live Windows execution on the affected SF2 host; no Velocity changes were required.